CVS log for src/sys/kern/vfs_syscalls.c

Up to [cvs.NetBSD.org] / src / sys / kern

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

tweak restoration of asyncflag

Simply update mp->mnt_flag with asyncflag as it contains the correct value.
Use the same pattern as in the other two places (vfs_syscalls.c, ffs_wapbl.c).

NFC.

explain why MNT_ASYNC is temporarily cleared

related to PR kern/58564.

use the proper kernel pointer

don't fd_putfile() if you haven't grabbed a ref already.

the condition to call fd_getvnode() was changed, but the condition
to call fd_putfile() afterwards was not changed, leading to a panic
seen by Chavdar on current-users, probably.

builds, runs, seems obvious.

refactor slightly so we don't try to read the buffer supplied by userland.

remove the part of previous that crashes for now.

Ignore the file descriptor argument for absolute pathnames, per posix eg:
https://pubs.opengroup.org/onlinepubs/9699919799/functions/access.html

do_sys_accessat(): copy credentials only when needed.

Add memfd_create(2) from GSoC 2023 by Theodore Preduta

kern/vfs_syscalls.c: Nix trailing whitesapce.

No functional change intended.

kern: KASSERT(A && B) -> KASSERT(A); KASSERT(B)

Pull up following revision(s) (requested by riastradh in ticket #1806):

	sys/kern/vfs_syscalls.c: revision 1.557

open(2): Don't map ERESTART to EINTR.

If a file or device's open function returns ERESTART, respect that --
restart the syscall; don't pretend a signal has been delivered when
it was not.  If an SA_RESTART signal was delivered, POSIX does not
allow it to fail with EINTR:

    SA_RESTART
        This flag affects the behavior of interruptible functions;
        that is, those specified to fail with errno set to [EINTR].
        If set, and a function specified as interruptible is
        interrupted by this signal, the function shall restart and
        shall not fail with [EINTR] unless otherwise specified.  If
        an interruptible function which uses a timeout is restarted,
        the duration of the timeout following the restart is set to
        an unspecified value that does not exceed the original
        timeout value.  If the flag is not set, interruptible
        functions interrupted by this signal shall fail with errno
        set to [EINTR].

https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaction.html

Nothing in the POSIX definition of open specifies otherwise.

In 1990, Kirk McKusick added these lines with a mysterious commit
message:
Author: Kirk McKusick <mckusick>
Date:   Tue Apr 10 19:36:33 1990 -0800
    eliminate longjmp from the kernel (for karels)
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 7bc7b39bbf..d572d3a32d 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -14,7 +14,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- *     @(#)vfs_syscalls.c      7.42 (Berkeley) 3/26/90
+ *     @(#)vfs_syscalls.c      7.43 (Berkeley) 4/10/90
  */
 #include "param.h"
@@ -530,8 +530,10 @@ copen(scp, fmode, cmode, ndp, resultfd)
        if (error = vn_open(ndp, fmode, (cmode & 07777) &~ S_ISVTX)) {
                crfree(fp->f_cred);
                fp->f_count--;
-               if (error == -1)        /* XXX from fdopen */
-                       return (0);     /* XXX from fdopen */
+               if (error == EJUSTRETURN)       /* XXX from fdopen */
+                       return (0);             /* XXX from fdopen */
+               if (error == ERESTART)
+                       error = EINTR;
                scp->sc_ofile[indx] = NULL;
                return (error);
        }

(found via this git import of the CSRG history:
https://github.com/robohack/ucb-csrg-bsd/commit/cce2869b7ae5d360921eb411005b328a29c4a3fe

This change appears to have served two related purposes:
1. The fdopen function (the erstwhile open routine for /dev/fd/N)
   used to return -1 as a hack to mean it had just duplicated the fd;
   it was recently changed by Mike Karels, in kern_descrip.c 7.9, to
   return EJUSTRETURN, now defined to be -2, presumably to avoid a
   conflict with ERESTART, defined to be -1.  So this change finished
   part of the change by Mike Karels to use a different magic return
   code from fdopen.
   Of course, today we use still another disgusting hack, EDUPFD, for
   the same purpose, so none of this is relevant any more.
2. Prior to April 1990, the kernel handled signals during tsleep(9)
   by longjmping out to the system call entry point or similar.  In
   April 1990, Mike Karels worked to convert all of that into
   explicit unwind logic by passing through EINTR or ERESTART as
   appropriate, instead of setjmp at each entry point.

However, it's not clear to me why this setjmp/longjmp and
fdopen/-1/EJUSTRETURN renovation justifies unconditional logic to map
ERESTART to EINTR in open(2).  I suspect it was a mistake.

In 2013, the corresponding logic to map ERESTART to EINTR in open(2)
was removed from FreeBSD:

   r246472 | kib | 2013-02-07 14:53:33 +0000 (Thu, 07 Feb 2013) | 11 lines
   Stop translating the ERESTART error from the open(2) into EINTR.
   Posix requires that open(2) is restartable for SA_RESTART.
   For non-posix objects, in particular, devfs nodes, still disable
   automatic restart of the opens. The open call to a driver could have
   significant side effects for the hardware.
   Noted and reviewed by:  jilles
   Discussed with: bde
   MFC after:      2 weeks

Index: vfs_syscalls.c
===================================================================
--- vfs_syscalls.c      (revision 246471)
+++ vfs_syscalls.c      (revision 246472)
@@ -1106,8 +1106,6 @@
                                goto success;
                }
-               if (error == ERESTART)
-                       error = EINTR;
                goto bad;
        }
        td->td_dupfd = 0;

https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c">https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c

It's not clear to me that there's any reason to treat device nodes
specially here; in fact, if a driver's .d_open routine sleeps and is
woken by a concurrent revoke without a signal pending or with an
SA_RESTART signal pending, it is wrong for it to fail with EINTR.

But it MUST restart the whole system call rather than continue
sleeping in a loop or just exit the loop and continue to open,
because it is mandatory in the security model of revoke for open(2)
to retry the permissions check at that point.

PR kern/57260

Pull up following revision(s) (requested by riastradh in ticket #1610):

	sys/kern/vfs_syscalls.c: revision 1.557

open(2): Don't map ERESTART to EINTR.

If a file or device's open function returns ERESTART, respect that --
restart the syscall; don't pretend a signal has been delivered when
it was not.  If an SA_RESTART signal was delivered, POSIX does not
allow it to fail with EINTR:

    SA_RESTART
        This flag affects the behavior of interruptible functions;
        that is, those specified to fail with errno set to [EINTR].
        If set, and a function specified as interruptible is
        interrupted by this signal, the function shall restart and
        shall not fail with [EINTR] unless otherwise specified.  If
        an interruptible function which uses a timeout is restarted,
        the duration of the timeout following the restart is set to
        an unspecified value that does not exceed the original
        timeout value.  If the flag is not set, interruptible
        functions interrupted by this signal shall fail with errno
        set to [EINTR].

https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaction.html

Nothing in the POSIX definition of open specifies otherwise.

In 1990, Kirk McKusick added these lines with a mysterious commit
message:
Author: Kirk McKusick <mckusick>
Date:   Tue Apr 10 19:36:33 1990 -0800
    eliminate longjmp from the kernel (for karels)
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 7bc7b39bbf..d572d3a32d 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -14,7 +14,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- *     @(#)vfs_syscalls.c      7.42 (Berkeley) 3/26/90
+ *     @(#)vfs_syscalls.c      7.43 (Berkeley) 4/10/90
  */
 #include "param.h"
@@ -530,8 +530,10 @@ copen(scp, fmode, cmode, ndp, resultfd)
        if (error = vn_open(ndp, fmode, (cmode & 07777) &~ S_ISVTX)) {
                crfree(fp->f_cred);
                fp->f_count--;
-               if (error == -1)        /* XXX from fdopen */
-                       return (0);     /* XXX from fdopen */
+               if (error == EJUSTRETURN)       /* XXX from fdopen */
+                       return (0);             /* XXX from fdopen */
+               if (error == ERESTART)
+                       error = EINTR;
                scp->sc_ofile[indx] = NULL;
                return (error);
        }

(found via this git import of the CSRG history:
https://github.com/robohack/ucb-csrg-bsd/commit/cce2869b7ae5d360921eb411005b328a29c4a3fe

This change appears to have served two related purposes:
1. The fdopen function (the erstwhile open routine for /dev/fd/N)
   used to return -1 as a hack to mean it had just duplicated the fd;
   it was recently changed by Mike Karels, in kern_descrip.c 7.9, to
   return EJUSTRETURN, now defined to be -2, presumably to avoid a
   conflict with ERESTART, defined to be -1.  So this change finished
   part of the change by Mike Karels to use a different magic return
   code from fdopen.
   Of course, today we use still another disgusting hack, EDUPFD, for
   the same purpose, so none of this is relevant any more.
2. Prior to April 1990, the kernel handled signals during tsleep(9)
   by longjmping out to the system call entry point or similar.  In
   April 1990, Mike Karels worked to convert all of that into
   explicit unwind logic by passing through EINTR or ERESTART as
   appropriate, instead of setjmp at each entry point.

However, it's not clear to me why this setjmp/longjmp and
fdopen/-1/EJUSTRETURN renovation justifies unconditional logic to map
ERESTART to EINTR in open(2).  I suspect it was a mistake.

In 2013, the corresponding logic to map ERESTART to EINTR in open(2)
was removed from FreeBSD:

   r246472 | kib | 2013-02-07 14:53:33 +0000 (Thu, 07 Feb 2013) | 11 lines
   Stop translating the ERESTART error from the open(2) into EINTR.
   Posix requires that open(2) is restartable for SA_RESTART.
   For non-posix objects, in particular, devfs nodes, still disable
   automatic restart of the opens. The open call to a driver could have
   significant side effects for the hardware.
   Noted and reviewed by:  jilles
   Discussed with: bde
   MFC after:      2 weeks

Index: vfs_syscalls.c
===================================================================
--- vfs_syscalls.c      (revision 246471)
+++ vfs_syscalls.c      (revision 246472)
@@ -1106,8 +1106,6 @@
                                goto success;
                }
-               if (error == ERESTART)
-                       error = EINTR;
                goto bad;
        }
        td->td_dupfd = 0;

https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c">https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c

It's not clear to me that there's any reason to treat device nodes
specially here; in fact, if a driver's .d_open routine sleeps and is
woken by a concurrent revoke without a signal pending or with an
SA_RESTART signal pending, it is wrong for it to fail with EINTR.

But it MUST restart the whole system call rather than continue
sleeping in a loop or just exit the loop and continue to open,
because it is mandatory in the security model of revoke for open(2)
to retry the permissions check at that point.

PR kern/57260

Pull up following revision(s) (requested by riastradh in ticket #115):

	sys/kern/vfs_syscalls.c: revision 1.557

open(2): Don't map ERESTART to EINTR.

If a file or device's open function returns ERESTART, respect that --
restart the syscall; don't pretend a signal has been delivered when
it was not.  If an SA_RESTART signal was delivered, POSIX does not
allow it to fail with EINTR:

    SA_RESTART
        This flag affects the behavior of interruptible functions;
        that is, those specified to fail with errno set to [EINTR].
        If set, and a function specified as interruptible is
        interrupted by this signal, the function shall restart and
        shall not fail with [EINTR] unless otherwise specified.  If
        an interruptible function which uses a timeout is restarted,
        the duration of the timeout following the restart is set to
        an unspecified value that does not exceed the original
        timeout value.  If the flag is not set, interruptible
        functions interrupted by this signal shall fail with errno
        set to [EINTR].

https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaction.html

Nothing in the POSIX definition of open specifies otherwise.

In 1990, Kirk McKusick added these lines with a mysterious commit
message:
Author: Kirk McKusick <mckusick>
Date:   Tue Apr 10 19:36:33 1990 -0800
    eliminate longjmp from the kernel (for karels)
diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 7bc7b39bbf..d572d3a32d 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -14,7 +14,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- *     @(#)vfs_syscalls.c      7.42 (Berkeley) 3/26/90
+ *     @(#)vfs_syscalls.c      7.43 (Berkeley) 4/10/90
  */
 #include "param.h"
@@ -530,8 +530,10 @@ copen(scp, fmode, cmode, ndp, resultfd)
        if (error = vn_open(ndp, fmode, (cmode & 07777) &~ S_ISVTX)) {
                crfree(fp->f_cred);
                fp->f_count--;
-               if (error == -1)        /* XXX from fdopen */
-                       return (0);     /* XXX from fdopen */
+               if (error == EJUSTRETURN)       /* XXX from fdopen */
+                       return (0);             /* XXX from fdopen */
+               if (error == ERESTART)
+                       error = EINTR;
                scp->sc_ofile[indx] = NULL;
                return (error);
        }

(found via this git import of the CSRG history:
https://github.com/robohack/ucb-csrg-bsd/commit/cce2869b7ae5d360921eb411005b328a29c4a3fe

This change appears to have served two related purposes:
1. The fdopen function (the erstwhile open routine for /dev/fd/N)
   used to return -1 as a hack to mean it had just duplicated the fd;
   it was recently changed by Mike Karels, in kern_descrip.c 7.9, to
   return EJUSTRETURN, now defined to be -2, presumably to avoid a
   conflict with ERESTART, defined to be -1.  So this change finished
   part of the change by Mike Karels to use a different magic return
   code from fdopen.
   Of course, today we use still another disgusting hack, EDUPFD, for
   the same purpose, so none of this is relevant any more.
2. Prior to April 1990, the kernel handled signals during tsleep(9)
   by longjmping out to the system call entry point or similar.  In
   April 1990, Mike Karels worked to convert all of that into
   explicit unwind logic by passing through EINTR or ERESTART as
   appropriate, instead of setjmp at each entry point.

However, it's not clear to me why this setjmp/longjmp and
fdopen/-1/EJUSTRETURN renovation justifies unconditional logic to map
ERESTART to EINTR in open(2).  I suspect it was a mistake.

In 2013, the corresponding logic to map ERESTART to EINTR in open(2)
was removed from FreeBSD:

   r246472 | kib | 2013-02-07 14:53:33 +0000 (Thu, 07 Feb 2013) | 11 lines
   Stop translating the ERESTART error from the open(2) into EINTR.
   Posix requires that open(2) is restartable for SA_RESTART.
   For non-posix objects, in particular, devfs nodes, still disable
   automatic restart of the opens. The open call to a driver could have
   significant side effects for the hardware.
   Noted and reviewed by:  jilles
   Discussed with: bde
   MFC after:      2 weeks

Index: vfs_syscalls.c
===================================================================
--- vfs_syscalls.c      (revision 246471)
+++ vfs_syscalls.c      (revision 246472)
@@ -1106,8 +1106,6 @@
                                goto success;
                }
-               if (error == ERESTART)
-                       error = EINTR;
                goto bad;
        }
        td->td_dupfd = 0;

https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c">https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c

It's not clear to me that there's any reason to treat device nodes
specially here; in fact, if a driver's .d_open routine sleeps and is
woken by a concurrent revoke without a signal pending or with an
SA_RESTART signal pending, it is wrong for it to fail with EINTR.

But it MUST restart the whole system call rather than continue
sleeping in a loop or just exit the loop and continue to open,
because it is mandatory in the security model of revoke for open(2)
to retry the permissions check at that point.

PR kern/57260

open(2): Don't map ERESTART to EINTR.

If a file or device's open function returns ERESTART, respect that --
restart the syscall; don't pretend a signal has been delivered when
it was not.  If an SA_RESTART signal was delivered, POSIX does not
allow it to fail with EINTR:

    SA_RESTART
        This flag affects the behavior of interruptible functions;
        that is, those specified to fail with errno set to [EINTR].
        If set, and a function specified as interruptible is
        interrupted by this signal, the function shall restart and
        shall not fail with [EINTR] unless otherwise specified.  If
        an interruptible function which uses a timeout is restarted,
        the duration of the timeout following the restart is set to
        an unspecified value that does not exceed the original
        timeout value.  If the flag is not set, interruptible
        functions interrupted by this signal shall fail with errno
        set to [EINTR].

https://pubs.opengroup.org/onlinepubs/9699919799/functions/sigaction.html

Nothing in the POSIX definition of open specifies otherwise.

In 1990, Kirk McKusick added these lines with a mysterious commit
message:

Author: Kirk McKusick <mckusick>
Date:   Tue Apr 10 19:36:33 1990 -0800

    eliminate longjmp from the kernel (for karels)

diff --git a/sys/kern/vfs_syscalls.c b/sys/kern/vfs_syscalls.c
index 7bc7b39bbf..d572d3a32d 100644
--- a/sys/kern/vfs_syscalls.c
+++ b/sys/kern/vfs_syscalls.c
@@ -14,7 +14,7 @@
  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  *
- *	@(#)vfs_syscalls.c	7.42 (Berkeley) 3/26/90
+ *	@(#)vfs_syscalls.c	7.43 (Berkeley) 4/10/90
  */

 #include "param.h"
@@ -530,8 +530,10 @@ copen(scp, fmode, cmode, ndp, resultfd)
 	if (error = vn_open(ndp, fmode, (cmode & 07777) &~ S_ISVTX)) {
 		crfree(fp->f_cred);
 		fp->f_count--;
-		if (error == -1)	/* XXX from fdopen */
-			return (0);	/* XXX from fdopen */
+		if (error == EJUSTRETURN)	/* XXX from fdopen */
+			return (0);		/* XXX from fdopen */
+		if (error == ERESTART)
+			error = EINTR;
 		scp->sc_ofile[indx] = NULL;
 		return (error);
 	}

(found via this git import of the CSRG history:
https://github.com/robohack/ucb-csrg-bsd/commit/cce2869b7ae5d360921eb411005b328a29c4a3fe)

This change appears to have served two related purposes:

1. The fdopen function (the erstwhile open routine for /dev/fd/N)
   used to return -1 as a hack to mean it had just duplicated the fd;
   it was recently changed by Mike Karels, in kern_descrip.c 7.9, to
   return EJUSTRETURN, now defined to be -2, presumably to avoid a
   conflict with ERESTART, defined to be -1.  So this change finished
   part of the change by Mike Karels to use a different magic return
   code from fdopen.

   Of course, today we use still another disgusting hack, EDUPFD, for
   the same purpose, so none of this is relevant any more.

2. Prior to April 1990, the kernel handled signals during tsleep(9)
   by longjmping out to the system call entry point or similar.  In
   April 1990, Mike Karels worked to convert all of that into
   explicit unwind logic by passing through EINTR or ERESTART as
   appropriate, instead of setjmp at each entry point.

However, it's not clear to me why this setjmp/longjmp and
fdopen/-1/EJUSTRETURN renovation justifies unconditional logic to map
ERESTART to EINTR in open(2).  I suspect it was a mistake.

In 2013, the corresponding logic to map ERESTART to EINTR in open(2)
was removed from FreeBSD:

   r246472 | kib | 2013-02-07 14:53:33 +0000 (Thu, 07 Feb 2013) | 11 lines

   Stop translating the ERESTART error from the open(2) into EINTR.
   Posix requires that open(2) is restartable for SA_RESTART.

   For non-posix objects, in particular, devfs nodes, still disable
   automatic restart of the opens. The open call to a driver could have
   significant side effects for the hardware.

   Noted and reviewed by:  jilles
   Discussed with: bde
   MFC after:      2 weeks

Index: vfs_syscalls.c
===================================================================
--- vfs_syscalls.c	(revision 246471)
+++ vfs_syscalls.c	(revision 246472)
@@ -1106,8 +1106,6 @@
 				goto success;
 		}

-		if (error == ERESTART)
-			error = EINTR;
 		goto bad;
 	}
 	td->td_dupfd = 0;

https://cgit.freebsd.org/src/commit/sys/kern/vfs_syscalls.c?id=2ca49983425886121b506cb5126b60a705afc38c

It's not clear to me that there's any reason to treat device nodes
specially here; in fact, if a driver's .d_open routine sleeps and is
woken by a concurrent revoke without a signal pending or with an
SA_RESTART signal pending, it is wrong for it to fail with EINTR.
But it MUST restart the whole system call rather than continue
sleeping in a loop or just exit the loop and continue to open,
because it is mandatory in the security model of revoke for open(2)
to retry the permissions check at that point.

PR kern/57260

XXX pullup-8
XXX pullup-9
XXX pullup-10

fix various typos in comments and messages.

Add inline functions to manipulate the klists that link up knotes
via kn_selnext:

- klist_init()
- klist_fini()
- klist_insert()
- klist_remove()

These provide some API insulation from the implementation details of these
lists (but not completely; see vn_knote_attach() and vn_knote_detach()).
Currently just a wrapper around SLIST(9).

This will make it significantly easier to switch kn_selnext linkage
to a different kind of list.

Merge the kernel portion of the posix-spawn-chdir project by Piyush Sachdeva.

Fix the locking around EVFILT_FS.  Previously, the code would walk the
fs_klist and take the kqueue_misc_lock inside the event callback.
However, that list can be modified by the attach and detach callbacks,
which could result in the walker stepping right off a cliff.

Instead, we give the fs_klist it's own lock, and hold it while we
call knote(), using the NOTE_SUBMIT protocol.  Also, fs_filtops
into vfs_syscalls.c so all of the locking logic is contained in one
file (there is precedence with sig_filtops).  fs_filtops is now marked
MPSAFE.

sys/kern: Allow custom fileops to specify fo_seek method.

Previously only vnodes allowed lseek/pread[v]/pwrite[v], which meant
converting a regular device to a cloning device doesn't always work.

Semantics is:

(*fp->f_ops->fo_seek)(fp, delta, whence, newoffp, flags)

1. Compute a new offset according to whence + delta -- that is, if
   whence is SEEK_CUR, add delta to fp->f_offset; if whence is
   SEEK_END, add delta to end of file; if whence is SEEK_CUR, use delta
   as is.

2. If newoffp is nonnull, return the new offset in *newoffp.

3. If flags & FOF_UPDATE_OFFSET, set fp->f_offset to the new offset.

Access to fp->f_offset, and *newoffp if newoffp = &fp->f_offset, must
happen under the object lock (e.g., vnode lock), in order to
synchronize fp->f_offset reads and writes.

This change has the side effect that every call to VOP_SEEK happens
under the vnode lock now, when previously it didn't.  However, from a
review of all the VOP_SEEK implementations, it does not appear that
any file system even examines the vnode, let alone locks it.  So I
think this is safe -- and essentially the only reasonable way to do
things, given that it is used to validate a change from oldoff to
newoff, and oldoff becomes stale the moment we unlock the vnode.

No kernel bump because this reuses a spare entry in struct fileops,
and it is safe for the entry to be null, so all existing fileops will
continue to work as before (rejecting seek).

Sync with HEAD.

Return error from fd_dupopen.

Add containment for the cloning devices hack in vn_open.

Cloning devices (and also things like /dev/stderr) work by allocating
a struct file, stuffing it in the file table (which is a layer
violation), stuffing the file descriptor number for it in a magic
field of struct lwp (which is gross), and then "failing" with one of
two magic errnos, EDUPFD or EMOVEFD.

Before this commit, all callers of vn_open in the kernel (there are
quite a few) were expected to check for these errors and handle the
situation. Needless to say, none of them except for open() itself did,
resulting in internal negative errnos being returned to userspace.

This hack is fairly deeply rooted and cannot be eliminated all at
once. This commit adds logic to handle the magic errnos inside
vn_open; now on success vn_open returns either a vnode or an integer
file descriptor, along with a flag that says whether the underlying
code requested EDUPFD or EMOVEFD. Callers not prepared to cope with
file descriptors can pass NULL for the extra return values, in which
case if a file descriptor would be produced vn_open fails with
EOPNOTSUPP.

Since I'm rearranging vn_open's signature anyway, stop exposing struct
nameidata. Instead, take three arguments: an optional vnode to use as
the starting point (like openat()), the path, and additional namei
flags to use, restricted to NOCHROOT and TRYEMULROOT. (Other namei
behavior, e.g. NOFOLLOW, can be requested via the open flags.)

This change requires a kernel bump. Ride the one an hour ago.
(That was supposed to be coordinated; did not intend to let an hour
slip by. My fault.)

Sync with HEAD.

Don't allow callers of fsync_range() to trigger UB in the kernel.

(also prohibit syncing ranges at start offsets less than zero)

Add ACL support for FFS. From FreeBSD.

Sync with bouyer-xenpvh-base2 (HEAD)

Pull up following revision(s) (requested by gdt in ticket #1534):

	sys/kern/vfs_syscalls.c: revision 1.544
	lib/libc/sys/fdatasync.2: revision 1.17

Relax fdatasync restriction that fd be writable

The restriction that a fd passed to fdatasync(2) must be writable was
added in 2003 in order to comply with POSIX.  Since then, POSIX has
removed that requirement, and POSIX-valid programs have been therefore
encountering errors on NetBSD.

Patch by Paul Ripke after discussion on netbsd-users.  Issue
discovered with pkgsrc/databases/mongodb3 as used by pkgsrc/net/unifi.

Pull up following revision(s) (requested by gdt in ticket #840):

	sys/kern/vfs_syscalls.c: revision 1.544
	lib/libc/sys/fdatasync.2: revision 1.17

Relax fdatasync restriction that fd be writable

The restriction that a fd passed to fdatasync(2) must be writable was
added in 2003 in order to comply with POSIX.  Since then, POSIX has
removed that requirement, and POSIX-valid programs have been therefore
encountering errors on NetBSD.

Patch by Paul Ripke after discussion on netbsd-users.  Issue
discovered with pkgsrc/databases/mongodb3 as used by pkgsrc/net/unifi.

Revert the changes made in February to make cwdinfo use mostly lockless,
which relied on taking extra vnode refs.

Having benchmarked various experimental changes over the past few months it
seems that it's better to avoid vnode refs as much as possible.  cwdi_lock
as a RW lock already did that to some extent for getcwd() and will permit
the same for namei() too.

Sync with HEAD

Rename buf_syncwait() to vfs_syncwait(), and have it wait on v_numoutput
rather than BC_BUSY.  Removes the dependency on bufhash.

Mostly merge changes from HEAD upto 20200411

Merge changes from current as of 20200406

Merge the remaining changes from the ad-namecache branch, affecting namei()
and getcwd():

- push vnode locking back as far as possible.
- do most lookups directly in the namecache, avoiding vnode locks & refs.
- don't block new refs to vnodes across VOP_INACTIVE().
- get shared locks for VOP_LOOKUP() if the file system supports it.
- correct lock types for VOP_ACCESS() / VOP_GETATTR() in a few places.

Possible future enhancements:

- make the lookups lockless.
- support dotdot lookups by being lockless and inferring absence of chroot.
- maybe make it work for layered file systems.
- avoid vnode references at the root & cwd.

Relax fdatasync restriction that fd be writable

The restriction that a fd passed to fdatasync(2) must be writable was
added in 2003 in order to comply with POSIX.  Since then, POSIX has
removed that requirement, and POSIX-valid programs have been therefore
encountering errors on NetBSD.

Patch by Paul Ripke after discussion on netbsd-users.  Issue
discovered with pkgsrc/databases/mongodb3 as used by pkgsrc/net/unifi.

don't skip the rdir check for the lazy case; breaks chroot df(1) hiding.

Sync with head.

Merge from ad-namecache:

- Have a stab at clustering the members of vnode_t and vnode_impl_t in a
  more cache-conscious way.  With that done, go back to adjusting v_usecount
  with atomics and keep vi_lock directly in vnode_impl_t (saves KVA).

- Allow VOP_LOCK(LK_NONE) for the benefit of VFS_VGET() and VFS_ROOT().
  Make sure LK_UPGRADE always comes with LK_NOWAIT.

- Make cwdinfo use mostly lockless.

Inline the block in the parent block, for clarity, and also to prevent a
false positive with kMSan.

Here, LLVM reorders the conditions and checks 'vattr' before 'error'. But
if 'error' is non-zero then 'vattr' is not initialized, and kMSan notices
the uninitialized memory read.

Make cwdinfo use mostly lockless, and largely hide the details in vfs_cwd.c.

Use LOCKLEAF in the few cases it's useful for ffs/tmpfs/nullfs.  Others need
to be checked.

Sync with head.

VFS_VGET(), VFS_ROOT(), VFS_FHTOVP(): give them a "int lktype" argument, to
allow us to get shared locks (or no lock) on the returned vnode.  Matches
FreeBSD.

sys_fchdir: use LK_SHARED.

Make mntvnode_lock per-mount, and address false sharing of struct mount.

make nmountcompatnames unsigned (assigned from __arraycount, compared with
unsigned in compat code)

Add a new member to struct vfsstat and grow the unused members
The new member is caled f_mntfromlabel and it is the dkw_wname
of the corresponding wedge. This is now used by df -W to display
the mountpoint name as NAME=

Validate usec ranges in do_sys_utimes()

sys/kern/vfs_syscalls.c:3939:4, signed integer overflow: 503923632 * 1000 cannot be represented in type 'int'

Reported-by: syzbot+4cfc86ffd30e8678f68d@syzkaller.appspotmail.com

Prevent O_EXEC for mq_open(2), and O_EXEC with a writable fd for open(2).

Fix bug: if seg == UIO_SYSSPACE, tv[] is not initialized. The branches
should depend on tptr[] instead.

Restore ability to create regular files with mknod(2)

This behavior is requested in ATF tests.

Add mkfifo{,at}(2) mode in mknod{,at}(2) as requested by POSIX

mknod with mode & S_IFIFO and dev=0 shall behave like mkfifo.

Update the documentation to reflect this state.

Add ATF tests.

This is an in-kernel implementation as typically user-space programs use
mkfifo(2) directly, however whenever there is need to bypass libc (like in
valgrind) then portable POSIX software calls the mknod syscall.

Noted on tech-kern@ by Greg Troxel.

Correct wrong type of uio_seg passed to do_sys_mknodat()

It was introduced by an accident in previous commit to this file.

Detected by syzbot:
https://syzkaller.appspot.com/text?tag=CrashLog&x=16635d9ea00000

Drop unused retval pointer from do_sys_mknod{,at}()

No functional change intended.

Sync with HEAD

do_sys_mkdir(): pass the requested segment down to do_sys_mkdirat().

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Bracket do_sys_renameat() and nfsrv_rename() with fstrans.

The v_mount field for vnodes on the same file system as "from"
is now stable for referenced vnodes.

VFS_RENAMELOCK no longer may use lock from an unreferenced and
freed "struct mount".

Don't allow MNT_UNION on the root, there is no covered filesystem.

Fixes PR 53850

The panic for fopen(NULL, ... is back, fix it

Restore the original behavior before merging the compat refactoring branch.

Now:
 - no compat_10 -> perform pathbuf_copyin() and report EFAULT
 - compat_10 and error -> report error
 - compat_10 and success -> return file descriptor for "."

PR kern/53948

If the openat_10 hook is present and it returns success, continue with
the rest of the syscall; don't return prematurely, as we'll report
success (return value 0) but won't have set up the fd.

Correctly handle the NULL path when no compat_10 code is available.

This should address kern/53948 (thanks, kamil@, for the PR and for
testing the fix)

Do not resolve fdat for openat(2) if path is absolute

Opengroup says "The openat() function shall be equivalent to the open() function except in the case where path specifies a relative path", but
says nothing about fdat usage when path is absolute;
https://pubs.opengroup.org/onlinepubs/9699919799/functions/open.html

 We used to always reslove fdat, leading to error if it was invalid (e.g.: -1). That caused portability problem with other systems that
 just ignore it. See discussion in a pull request to work around that
 problem with MariaDB: https://github.com/MariaDB/server/pull/838

 We fix the problem by ignoring fdat when path is absolute.

Normalize all the compat hooks' names to the form

	<subsystem>_<function>_<version>_hook

NFCI

XXX Note that although this introduces a change in the kernel-to-
XXX module interface, we are NOT bumping the kernel version number.
XXX We will bump the version number once the interface stabilizes.

Merge the [pgoyette-compat] branch

Convert the MODULE_{,VOID_}HOOK_CALL macros to do everything in-line
rather than defining an intermediate hook##call function.  Almost
all of the hooks are called only once, and although we lose the
ability of doing things like

	if (MODULE_HOOK_CALL(...) == 0) ...

we simplify things quite a bit.  With this change, we no longer need
to have both declaration and definition macros, and the definition
no longer needs to have both prototype argument list and a "real"
argument list.

FWIW, the above if now needs to written as

	int ret;

	MODULE_HOOK_CALL(..., ret);
	if (ret == 0) ...

with appropriate use of braces {}.

Don't restrict hooks to having only int or void types.  Pass the hook's
type to the various macros, as needed.

Allows us to reduce diffs to original in at least one or two places (we
no longer have to provide an additional parameter to the hook routine
for returning a non-int return value).

Create a variant of the HOOK macros that handles hook routines of
type void, and use them where appropriate.

Remove the HOOK2 versions of the MODULE_HOOK macros.  There were
only a few uses, and using them led to some lack of clarity in the
code.  Instead, we now use two separate hooks, with names that
make it clear(er) what we're doing.

This also positions us to start unraveling some of the rtsock_50
mess, which will need (at least) five hooks.

Convert the openat_10 hook to use the MP-safe mechanism

XXX Still to do: compat70_unp_addsockcred and sysvipc50_sysctl

Make do_openat()'s handling of path=NULL modular

Merge autofs support from: Tomohiro Kusumi
XXX: Does not work yet

update from HEAD

We computed the length of the string already, so use it...

Sync with HEAD

remove checks for failure after memory allocation calls that cannot fail:

  kmem_alloc() with KM_SLEEP
  kmem_zalloc() with KM_SLEEP
  percpu_alloc()
  pserialize_create()
  psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Sync with HEAD

Enter fstrans from _vfs_busy() and leave from vfs_unbusy().

Adapt sched_sync() and do_sys_sync().

Return ENOENT if trying to suspend an unmounted file system.

Change VOP_REMOVE and VOP_RMDIR to preserve lock/ref on dvp.

No change to vp -- the plan is to replace the node by the
componentname in the vop parameters, and let all directory vops do
lookups internally.

Proposed on tech-kern with no objections:
https://mail-index.netbsd.org/tech-kern/2017/04/17/msg021825.html

Sync with HEAD

Sync with HEAD

Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount.  Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch do_sys_sync() and do_sys_getvfsstat() to mountlist iterator.

Sync with HEAD

Fix a logic error introduced with Rev. 1.507: defer setting MNT_RDONLY
only if going from read-write to read-only.

Should fix PR kern/52045 (panic: ffs_sync: rofs mod, fs=/ after fsck)

Suspend the mounted file system while updating.

Change the protocol to update a mounted file system from read-write
to read-only and vice versa:

- Add an internal flag IMNT_WANTRDONLY.
- Set either IMNT_WANTRDWR or IMNT_WANTRDONLY if going from or to read-only.
- After successfull call to VFS_MOUNT() set or clear MNT_RDONLY.

Adapt tmpfs and rumpfs to the new protocol.  Other file systems will be
updated when they get the IMNT_CAN_RWTORO property.

Welcome to 7.99.64

Take fstrans_start before syncing a file system.

Sync with HEAD

Sync with HEAD

typo in comment

Sync with HEAD (as of 26th Dec)

Fix kern/50841: races in sys_lseek.

Fix inverted KASSERT

Apease bogus gcc warning.

Change do_sys_mount() so that it only takes as argument the type of the
drive instead of its associated vfsops. Makes it more friendly, and allows
compat binaries to autoload VFS modules if needed.

sent on tech-kern@, ok christos@

Sync with HEAD

Unused inits (harmless).

Found by Brainy.

Use NOFOLLOW intead of <empty>. Purely cosmetic as NOFOLLOW is 0, but
it's supposed to be there for clarity.

Sync with HEAD

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
  - vfs_syncer_add_to_worklist(struct mount *mp) to add
  - vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Cull unused INRENAME and INRELOOKUP from callers.

Make VOP_LINK return directory still locked and referenced.

Ride 7.99.10 bump.

But rename(..., "x/..") is still supposed to yield EINVAL.  Go figure.

Tests claim rename(..., "x/.") yields EISDIR, so do that.  Fixes zfs.

Sync with HEAD

Pull up following revision(s) (requested by martin in ticket #523):
	sys/kern/vfs_syscalls.c: revision 1.493
A syscall like posix_fallocate() that is not supposed to set errno in
userland needs to always return 0 and store the error code *retval.

A syscall like posix_fallocate() that is not supposed to set errno in
userland needs to always return 0 and store the error code *retval.

Pull up following revision(s) (requested by manu in ticket #276):
	sys/kern/vfs_syscalls.c: revision 1.492
Do not follow symlinks in sys_unmount()
There are situations where the underlying filesystem is unreachable
(e.g: NFS) causing symlink resolution to hang. Such a situation
should be avoided by using umount -f -R (force and raw), but while -R
causes the symlink resolution to be skipped in umount(8), the kernel was
still doing it in sys_unmount(). This changes fixes that.
When the -R flag is not given, umount(8) does symlinks resolution
through
realpath(3) before calling unmount(2), hence not doing it in the kernel
would not change behavior.

Do not follow symlinks in sys_unmount()

There are situations where the underlying filesystem is unreachable
(e.g: NFS) causing symlink resolution to hang. Such a situation
should be avoided by using umount -f -R (force and raw), but while -R
causes the symlink resolution to be skipped in umount(8), the kernel was
still doing it in sys_unmount(). This changes fixes that.

When the -R flag is not given, umount(8) does symlinks resolution through
realpath(3) before calling unmount(2), hence not doing it in the kernel
would not change behavior.

Pull up following revision(s) (requested by manu in ticket #1150):
	lib/libc/sys/truncate.2: revision 1.27
	sys/kern/vfs_syscalls.c: revision 1.484
Follow OpenGroup online documents for truncate[1] and ftruncate[2].
Fail with EINVAL for length argument negative values.
[1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/truncate.html
[2] http://pubs.opengroup.org/onlinepubs/9699919799/functions/ftruncate.html

Try not to use f_data, use f_{vnode,socket,pipe,mqueue,kqueue,ksem} to get
a correctly typed pointer.

Rebase to HEAD as of a few days ago.

Rebase.

'result' -> 'error'

typo in comment

Add fdiscard and posix_fallocate syscalls.

This is weird; 'abort' already does all this, so simply use goto abort.

Revert the following changes:

   src/sys/sys/quotactl.h 1.37
   src/sys/compat/netbsd32/netbsd32.h 1.101
   src/sys/compat/netbsd32/netbsd32_netbsd.c 1.188, 1.189
   src/sys/kern/vfs_quotactl.c 1.39
   src/sys/kern/vfs_syscalls.c 1.483
   src/sys/ufs/lfs/ulfs_quota.c 1.11
   src/sys/ufs/ufs/ufs_quota.c 1.116
   src/lib/libquota/quota_kernel.c 1.5

and do them correctly.

If you're going to change the name of something, you need to change
the name of *all* the things with the same name, not just a handful,
and you should change it to something similar so it still matches the
rest of the system rather than just picking an arbitrarily different
name.

Hi, Joerg.

To wit, rename the quotactl "delete" operation to "del", because
"delete" is a reserved word in C++ and for some reason Joerg wants to
run internal interfaces used only by C code through his C++ compiler.
Do not rename it to "remove" instead, because this doesn't match
libquota or the rest of the usage throughout the system; and rename
all the related identifiers, not just the ones that blew the mind of
Joerg's C++ compiler.

Because this is not a user-facing API (the only userland consumer
sys/quotactl.h is libquota) it is sort of ok to make arbitrary
source-incompatible changes; however, by the same token it's completely
unnecessary. If it *were* a user-facing API that someone might have a
semi-rational reason to want to run a C++ compiler on, it would be
incorrect to change it at this point.

Don't initialize the fh pointer to NULL when the allocation functions fail
and allow NULL in the free functions. It just leads to writing sloppy code
for no good reason.

Follow OpenGroup online documents for truncate[1] and ftruncate[2].
Fail with EINVAL for length argument negative values.

[1] http://pubs.opengroup.org/onlinepubs/9699919799/functions/truncate.html
[2] http://pubs.opengroup.org/onlinepubs/9699919799/functions/ftruncate.html

Don't t use a C++ keyword as field name.

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

Pull up the following revisions(s) (requested by maxv in ticket #1901):
	sys/kern/vfs_syscalls.c:	revision 1.478, 1.480 via patch
	sys/coda/coda_vfsops.c:		revision 1.81
	sys/fs/adosfs/advfsops.c:	revision 1.70
	sys/fs/cd9660/cd9660_vfsops.c:	revision 1.84
	sys/fs/efs/efs_vfsops.c:	revision 1.25
	sys/fs/filecorefs/filecore_vfsops.c:	revision 1.76
	sys/fs/hfs/hfs_vfsops.c:	revision 1.31
	sys/fs/msdosfs/msdosfs_vfsops.c:	revision 1.107
	sys/fs/ntfs/ntfs_vfsops.c:	revision 1.94
	sys/fs/ptyfs/ptyfs_vfsops.c:	revision 1.50 via patch
	sys/fs/puffs/puffs_vfsops.c:	revision 1.110 via patch
	sys/fs/smbfs/smbfs_vfsops.c:	revision 1.100
	sys/fs/sysvbfs/sysvbfs_vfsops.c:	revision 1.43
	sys/fs/tmpfs/tmpfs_vfsops.c:	revision 1.59 via patch
	sys/fs/udf/udf_vfsops.c:	revision 1.67
	sys/fs/union/union_vfsops.c:	revision 1.72
	sys/fs/unionfs/unionfs_vfsops.c:	revision 1.13
	sys/kern/vfs_syscalls.c:	revision 1.479
	sys/miscfs/nullfs/null_vfsops.c:	revision 1.88 via patch
	sys/miscfs/overlay/overlay_vfsops.c:	revision 1.61
	sys/miscfs/procfs/procfs_vfsops.c:	revision 1.91
	sys/miscfs/umapfs/umap_vfsops.c:	revision 1.92
	sys/nfs/nfs_vfsops.c:		revision 1.227
	sys/ufs/ext2fs/ext2fs_vfsops.c:	revision 1.180
	sys/ufs/ffs/ffs_vfsops.c:	revision 1.297
	sys/ufs/lfs/lfs_vfsops.c:	revision 1.321
	sys/ufs/mfs/mfs_vfsops.c:	revision 1.107

Due to missing checks in the mount syscall, and a wrong assumption on the
file systems side, the kernel could allocate an unbounded or zero-sized
memory buffer, and could dereference a NULL pointer when particular
arguments are given by a user.

Pull up the following revisions(s) (requested by maxv in ticket #1901):
	sys/kern/vfs_syscalls.c:	revision 1.478, 1.480 via patch
	sys/coda/coda_vfsops.c:		revision 1.81
	sys/fs/adosfs/advfsops.c:	revision 1.70
	sys/fs/cd9660/cd9660_vfsops.c:	revision 1.84
	sys/fs/efs/efs_vfsops.c:	revision 1.25
	sys/fs/filecorefs/filecore_vfsops.c:	revision 1.76
	sys/fs/hfs/hfs_vfsops.c:	revision 1.31
	sys/fs/msdosfs/msdosfs_vfsops.c:	revision 1.107
	sys/fs/ntfs/ntfs_vfsops.c:	revision 1.94
	sys/fs/ptyfs/ptyfs_vfsops.c:	revision 1.50 via patch
	sys/fs/puffs/puffs_vfsops.c:	revision 1.110 via patch
	sys/fs/smbfs/smbfs_vfsops.c:	revision 1.100
	sys/fs/sysvbfs/sysvbfs_vfsops.c:	revision 1.43
	sys/fs/tmpfs/tmpfs_vfsops.c:	revision 1.59 via patch
	sys/fs/udf/udf_vfsops.c:	revision 1.67
	sys/fs/union/union_vfsops.c:	revision 1.72
	sys/fs/unionfs/unionfs_vfsops.c:	revision 1.13
	sys/kern/vfs_syscalls.c:	revision 1.479
	sys/miscfs/nullfs/null_vfsops.c:	revision 1.88 via patch
	sys/miscfs/overlay/overlay_vfsops.c:	revision 1.61
	sys/miscfs/procfs/procfs_vfsops.c:	revision 1.91
	sys/miscfs/umapfs/umap_vfsops.c:	revision 1.92
	sys/nfs/nfs_vfsops.c:		revision 1.227
	sys/ufs/ext2fs/ext2fs_vfsops.c:	revision 1.180
	sys/ufs/ffs/ffs_vfsops.c:	revision 1.297
	sys/ufs/lfs/lfs_vfsops.c:	revision 1.321
	sys/ufs/mfs/mfs_vfsops.c:	revision 1.107

Due to missing checks in the mount syscall, and a wrong assumption on the
file systems side, the kernel could allocate an unbounded or zero-sized
memory buffer, and could dereference a NULL pointer when particular
arguments are given by a user.

Pull up the following revisions(s) (requested by maxv in ticket #1901):
	sys/kern/vfs_syscalls.c:	revision 1.478, 1.480 via patch
	sys/coda/coda_vfsops.c:		revision 1.81
	sys/fs/adosfs/advfsops.c:	revision 1.70
	sys/fs/cd9660/cd9660_vfsops.c:	revision 1.84
	sys/fs/efs/efs_vfsops.c:	revision 1.25
	sys/fs/filecorefs/filecore_vfsops.c:	revision 1.76
	sys/fs/hfs/hfs_vfsops.c:	revision 1.31
	sys/fs/msdosfs/msdosfs_vfsops.c:	revision 1.107
	sys/fs/ntfs/ntfs_vfsops.c:	revision 1.94
	sys/fs/ptyfs/ptyfs_vfsops.c:	revision 1.50 via patch
	sys/fs/puffs/puffs_vfsops.c:	revision 1.110 via patch
	sys/fs/smbfs/smbfs_vfsops.c:	revision 1.100
	sys/fs/sysvbfs/sysvbfs_vfsops.c:	revision 1.43
	sys/fs/tmpfs/tmpfs_vfsops.c:	revision 1.59 via patch
	sys/fs/udf/udf_vfsops.c:	revision 1.67
	sys/fs/union/union_vfsops.c:	revision 1.72
	sys/fs/unionfs/unionfs_vfsops.c:	revision 1.13
	sys/kern/vfs_syscalls.c:	revision 1.479
	sys/miscfs/nullfs/null_vfsops.c:	revision 1.88 via patch
	sys/miscfs/overlay/overlay_vfsops.c:	revision 1.61
	sys/miscfs/procfs/procfs_vfsops.c:	revision 1.91
	sys/miscfs/umapfs/umap_vfsops.c:	revision 1.92
	sys/nfs/nfs_vfsops.c:		revision 1.227
	sys/ufs/ext2fs/ext2fs_vfsops.c:	revision 1.180
	sys/ufs/ffs/ffs_vfsops.c:	revision 1.297
	sys/ufs/lfs/lfs_vfsops.c:	revision 1.321
	sys/ufs/mfs/mfs_vfsops.c:	revision 1.107

Due to missing checks in the mount syscall, and a wrong assumption on the
file systems side, the kernel could allocate an unbounded or zero-sized
memory buffer, and could dereference a NULL pointer when particular
arguments are given by a user.

Pull up following revision(s) (requested by maxv in ticket #1050):
	sys/ufs/chfs/chfs_vfsops.c: revision 1.11
	sys/fs/unionfs/unionfs_vfsops.c: revision 1.13
	sys/fs/nilfs/nilfs_vfsops.c: revision 1.16
	sys/ufs/mfs/mfs_vfsops.c: revision 1.107
	sys/fs/sysvbfs/sysvbfs_vfsops.c: revision 1.43
	sys/ufs/ffs/ffs_vfsops.c: revision 1.297
	sys/kern/vfs_syscalls.c: revision 1.478
	sys/kern/vfs_syscalls.c: revision 1.479
	sys/fs/puffs/puffs_vfsops.c: revision 1.110
	sys/fs/cd9660/cd9660_vfsops.c: revision 1.84
	sys/nfs/nfs_vfsops.c: revision 1.227
	sys/fs/v7fs/v7fs_vfsops.c: revision 1.10
	sys/ufs/ext2fs/ext2fs_vfsops.c: revision 1.180
	sys/miscfs/umapfs/umap_vfsops.c: revision 1.92
	sys/fs/filecorefs/filecore_vfsops.c: revision 1.76
	sys/miscfs/nullfs/null_vfsops.c: revision 1.88
	sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.50
	sys/coda/coda_vfsops.c: revision 1.81
	sys/ufs/lfs/lfs_vfsops.c: revision 1.321
	sys/fs/tmpfs/tmpfs_vfsops.c: revision 1.59
	sys/fs/hfs/hfs_vfsops.c: revision 1.31
	sys/miscfs/overlay/overlay_vfsops.c: revision 1.61
	sys/fs/union/union_vfsops.c: revision 1.72
	sys/fs/ntfs/ntfs_vfsops.c: revision 1.94
	sys/kern/vfs_syscalls.c: revision 1.480
	sys/fs/efs/efs_vfsops.c: revision 1.25
	sys/kern/vfs_syscalls.c: revision 1.482
	sys/fs/msdosfs/msdosfs_vfsops.c: revision 1.107
	external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c: revision 1.12
	sys/miscfs/procfs/procfs_vfsops.c: revision 1.91
	sys/fs/smbfs/smbfs_vfsops.c: revision 1.100
	sys/fs/adosfs/advfsops.c: revision 1.70
	sys/fs/udf/udf_vfsops.c: revision 1.67
Limit check for 'data_len'. Otherwise a (un)privileged user can easily
panic the system by passing a huge size.
ok christos@
An (un)privileged user can easily make the kernel dereference a NULL
pointer.
The kernel allows 'data' to be NULL; it's the fs's responsibility to
ensure that it isn't NULL (if the fs actually needs data).
ok christos@
Some fs's - like kernfs - set their vfs_min_mount_data to zero. Add a check
to prevent an (un)privileged user from requesting a zero-sized allocation
(and thus a panic).
This thing is totally buggy: 'data_len' is modified by the fs, so calling
kmem_free with it while its value has changed since the kmem_alloc is far
from being a good idea.
If the kernel figures out that something mismatches, it will panic
(typically with kernfs).

Pull up following revision(s) (requested by maxv in ticket #1050):
	sys/ufs/chfs/chfs_vfsops.c: revision 1.11
	sys/fs/unionfs/unionfs_vfsops.c: revision 1.13
	sys/fs/nilfs/nilfs_vfsops.c: revision 1.16
	sys/ufs/mfs/mfs_vfsops.c: revision 1.107
	sys/fs/sysvbfs/sysvbfs_vfsops.c: revision 1.43
	sys/ufs/ffs/ffs_vfsops.c: revision 1.297
	sys/kern/vfs_syscalls.c: revision 1.478
	sys/kern/vfs_syscalls.c: revision 1.479
	sys/fs/puffs/puffs_vfsops.c: revision 1.110
	sys/fs/cd9660/cd9660_vfsops.c: revision 1.84
	sys/nfs/nfs_vfsops.c: revision 1.227
	sys/fs/v7fs/v7fs_vfsops.c: revision 1.10
	sys/ufs/ext2fs/ext2fs_vfsops.c: revision 1.180
	sys/miscfs/umapfs/umap_vfsops.c: revision 1.92
	sys/fs/filecorefs/filecore_vfsops.c: revision 1.76
	sys/miscfs/nullfs/null_vfsops.c: revision 1.88
	sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.50
	sys/coda/coda_vfsops.c: revision 1.81
	sys/ufs/lfs/lfs_vfsops.c: revision 1.321
	sys/fs/tmpfs/tmpfs_vfsops.c: revision 1.59
	sys/fs/hfs/hfs_vfsops.c: revision 1.31
	sys/miscfs/overlay/overlay_vfsops.c: revision 1.61
	sys/fs/union/union_vfsops.c: revision 1.72
	sys/fs/ntfs/ntfs_vfsops.c: revision 1.94
	sys/kern/vfs_syscalls.c: revision 1.480
	sys/fs/efs/efs_vfsops.c: revision 1.25
	sys/kern/vfs_syscalls.c: revision 1.482
	sys/fs/msdosfs/msdosfs_vfsops.c: revision 1.107
	external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c: revision 1.12
	sys/miscfs/procfs/procfs_vfsops.c: revision 1.91
	sys/fs/smbfs/smbfs_vfsops.c: revision 1.100
	sys/fs/adosfs/advfsops.c: revision 1.70
	sys/fs/udf/udf_vfsops.c: revision 1.67
Limit check for 'data_len'. Otherwise a (un)privileged user can easily
panic the system by passing a huge size.
ok christos@
An (un)privileged user can easily make the kernel dereference a NULL
pointer.
The kernel allows 'data' to be NULL; it's the fs's responsibility to
ensure that it isn't NULL (if the fs actually needs data).
ok christos@
Some fs's - like kernfs - set their vfs_min_mount_data to zero. Add a check
to prevent an (un)privileged user from requesting a zero-sized allocation
(and thus a panic).
This thing is totally buggy: 'data_len' is modified by the fs, so calling
kmem_free with it while its value has changed since the kmem_alloc is far
from being a good idea.
If the kernel figures out that something mismatches, it will panic
(typically with kernfs).

Pull up following revision(s) (requested by maxv in ticket #1050):
	sys/ufs/chfs/chfs_vfsops.c: revision 1.11
	sys/fs/unionfs/unionfs_vfsops.c: revision 1.13
	sys/fs/nilfs/nilfs_vfsops.c: revision 1.16
	sys/ufs/mfs/mfs_vfsops.c: revision 1.107
	sys/fs/sysvbfs/sysvbfs_vfsops.c: revision 1.43
	sys/ufs/ffs/ffs_vfsops.c: revision 1.297
	sys/kern/vfs_syscalls.c: revision 1.478
	sys/kern/vfs_syscalls.c: revision 1.479
	sys/fs/puffs/puffs_vfsops.c: revision 1.110
	sys/fs/cd9660/cd9660_vfsops.c: revision 1.84
	sys/nfs/nfs_vfsops.c: revision 1.227
	sys/fs/v7fs/v7fs_vfsops.c: revision 1.10
	sys/ufs/ext2fs/ext2fs_vfsops.c: revision 1.180
	sys/miscfs/umapfs/umap_vfsops.c: revision 1.92
	sys/fs/filecorefs/filecore_vfsops.c: revision 1.76
	sys/miscfs/nullfs/null_vfsops.c: revision 1.88
	sys/fs/ptyfs/ptyfs_vfsops.c: revision 1.50
	sys/coda/coda_vfsops.c: revision 1.81
	sys/ufs/lfs/lfs_vfsops.c: revision 1.321
	sys/fs/tmpfs/tmpfs_vfsops.c: revision 1.59
	sys/fs/hfs/hfs_vfsops.c: revision 1.31
	sys/miscfs/overlay/overlay_vfsops.c: revision 1.61
	sys/fs/union/union_vfsops.c: revision 1.72
	sys/fs/ntfs/ntfs_vfsops.c: revision 1.94
	sys/kern/vfs_syscalls.c: revision 1.480
	sys/fs/efs/efs_vfsops.c: revision 1.25
	sys/kern/vfs_syscalls.c: revision 1.482
	sys/fs/msdosfs/msdosfs_vfsops.c: revision 1.107
	external/cddl/osnet/dist/uts/common/fs/zfs/zfs_vfsops.c: revision 1.12
	sys/miscfs/procfs/procfs_vfsops.c: revision 1.91
	sys/fs/smbfs/smbfs_vfsops.c: revision 1.100
	sys/fs/adosfs/advfsops.c: revision 1.70
	sys/fs/udf/udf_vfsops.c: revision 1.67
Limit check for 'data_len'. Otherwise a (un)privileged user can easily
panic the system by passing a huge size.
ok christos@
An (un)privileged user can easily make the kernel dereference a NULL
pointer.
The kernel allows 'data' to be NULL; it's the fs's responsibility to
ensure that it isn't NULL (if the fs actually needs data).
ok christos@
Some fs's - like kernfs - set their vfs_min_mount_data to zero. Add a check
to prevent an (un)privileged user from requesting a zero-sized allocation
(and thus a panic).
This thing is totally buggy: 'data_len' is modified by the fs, so calling
kmem_free with it while its value has changed since the kmem_alloc is far
from being a good idea.
If the kernel figures out that something mismatches, it will panic
(typically with kernfs).

This thing is totally buggy: 'data_len' is modified by the fs, so calling
kmem_free with it while its value has changed since the kmem_alloc is far
from being a good idea.

If the kernel figures out that something mismatches, it will panic
(typically with kernfs).

Memory leak (only triggerable from root).

ok christos@

Some fs's - like kernfs - set their vfs_min_mount_data to zero. Add a check
to prevent an (un)privileged user from requesting a zero-sized allocation
(and thus a panic).

An (un)privileged user can easily make the kernel dereference a NULL
pointer.

The kernel allows 'data' to be NULL; it's the fs's responsibility to
ensure that it isn't NULL (if the fs actually needs data).

ok christos@

Limit check for 'data_len'. Otherwise a (un)privileged user can easily
panic the system by passing a huge size.

ok christos@

Fix a potential - but very unlikely - NULL pointer dereference.
(it does not introduce a new error code for open(), since
 pathbuf_copyin() is already there and can return ENOMEM)

Found by my code scanner.

Remove argument name from prototype.

Add compat_10, open NULL == open "."

expose do_open

Change vnode operations create, mknod, mkdir and symlink to return
the resulting vnode *vpp unlocked.

Discussed on tech-kern@

Welcome to 6.99.30

Change vnode operations create, mknod, mkdir and symlink to keep the
directory node dvp locked on return.

Discussed on tech-kern@

Welcome to 6.99.29

Change the queue.3 *_END(&head) macros to NULL. Since we don't have CIRCLEQ
anymore, all the macros expand to NULL anyway, so this improves readability.
Requested by rmind@

change the mountlist CIRCLEQ into a TAILQ

expose various do_*at() functions for compat_linux.

Change mknodat(2) device argument type from uint32_t to dev_t.
Adds needed extra PAD argument for 64bit alignment, and libc wrapper.

sync with head

sync with HEAD

Remove, in do_sys_renameat(), wrong KASSERTs that check for non NULL
from/to arguments. Such values are correctly handled by later
pathbuf_maybe_copyin() calls, that will fail with EFAULT.

ok from dholland@.

Make do_sys_utimensat public

export do_sys_statat for netbsd32

don't store random values in retval
http://m00nbsd.net/ae123a9bae03f7dde5c6d654412daf5a.html

resync with head

sync with head

sync with (a bit old) head

Revert defective O_SEARCH implementation committed by manu@ along with
the *at system calls on November 18th of last year. Reasons to revert
it include:
   - it is incorrect in a whole variety of ways (but fortunately, one
     of them is that the missing and improper permission checks have
     no net effect);
   - it was committed without review or discussion;
   - core ruled that all the new O_* flags pertaining to the *at calls
     needed to wait until their semantics could be clarified.

manu was asked to revert it on these grounds but has ignored the request.

I have left O_SEARCH defined and visible and made open() explicitly
ignore it. This way, most code that tries to use it will continue to
build and run. I've also arranged lib/libc/c063/t_o_search.c so that
the tests that make use of the O_SEARCH semantics will disappear until
O_SEARCH comes back, and fixed some mistakes and/or incorrect hacks
that were causing some of these to succeed despite the broken O_SEARCH
implementation.

Apply fix from hannken to ensure that VOP_ACCESS() is called on a
locked vnode for fd_nameiat(), fd_nameiat_simple() and do_sys_openat().
Fix both PR/47226 and PR/47255.

Resync to 2012-11-19 00:00:00 UTC

Use copyout to copy data from kernel out to userland!
Fixes PR kern/47217.

Add most system calls for POSIX extended API set, part 2, with test cases:
faccessat(2), fchmodat(2), fchownat(2), fstatat(2), mkdirat(2), mkfifoat(2),
mknodat(2), linkat(2), readlinkat(2), symlinkat(2), renameat(2), unlinkat(2),
utimensat(2), openat(2).

Also implement O_SEARCH for openat(2)

Still missing:
- some flags for openat(2)
- fexecve(2) implementation

sync with head

No, we can't elide the fs-wide rename lock for same-directory rename.

rename("a/b", "a/c") and rename("a/c/x", "a/b/y") will deadlock.

Darn.

Disentangle do_sys_rename.

Elide the fs-wide rename lock for single-directory renames.  This
required changing the order of lookups, so that we know what the
directories are before we lock the nodes.

Clean up error branches, explain why various nonsense happens and
what it does and doesn't do, and note some of what needs to change.

Add new action KAUTH_CRED_CHROOT for kauth(9)'s credential scope.
Reviewed and approved by elad@.

sync to latest -current.

sync with head.

Pull up following revision(s) (requested by manu in ticket #259):
	sys/kern/vfs_syscalls.c: revision 1.456
	sys/kern/vfs_mount.c: revision 1.14
	sys/kern/vfs_syscalls.c: revision 1.452
	sys/kern/vfs_syscalls.c: revision 1.453
	sys/kern/vfs_syscalls.c: revision 1.454
Do not use vp after mount_domount() call as it sets it to NULL on success.
This fixes a panic when starting extended attributes.
Fix mount -o extattr : previous patch fixed a panic but caused operation
to happen on the mount point instead of the mounted filesystem.
Fix the extattr start fix. Looking up the filesystemroot vnode again
does not seems to be reliable. Instead save it before mount_domount()
sets it to NULL.
Move VFS_EXTATTRCTL to mount_domount().  This makes the
fs/puffs/t_fuzz:mountfuzz7, fs/puffs/t_fuzz:mountfuzz8,
and fs/zfs/t_zpool:create tests pass again.  Patch from
manu, discussed on tech-kern and committed at his request.

Pull up following revision(s) (requested by rmind in ticket #246):
	sys/kern/vfs_syscalls.c: revision 1.455
do_open: move pathbuf destruction to the callers, thus simplify and fix a
memory leak on error path.

Move VFS_EXTATTRCTL to mount_domount().  This makes the
fs/puffs/t_fuzz:mountfuzz7, fs/puffs/t_fuzz:mountfuzz8,
and fs/zfs/t_zpool:create tests pass again.  Patch from
manu, discussed on tech-kern and committed at his request.

do_open: move pathbuf destruction to the callers, thus simplify and fix a
memory leak on error path.

Fix the extattr start fix. Looking up the filesystemroot vnode again
does not seems to be reliable. Instead save it before mount_domount()
sets it to NULL.

Fix mount -o extattr : previous patch fixed a panic but caused operation
to happen on the mount point instead of the mounted filesystem.

sync to latest -current.

Do not use vp after mount_domount() call as it sets it to NULL on success.
This fixes a panic when starting extended attributes.

it is not an error if the kernel needs to clear the setuid/
setgid bit on write/chown/chgrp

sync with head

sync to latest -current.

Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

    http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
    http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
    http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

merge to -current.

fd_open(): fix confusion between userland and kernel encoding of open flags

Add a posix_spawn syscall, as discussed on tech-kern.
Based on the summer of code project by Charles Zhang, heavily reworked
later by me - all bugs are likely mine.
Ok: core, releng.

Be consistent about whether idtype and objtype codes are signed or
unsigned. They are signed. (While unsigned might have been a better
choice, it doesn't really matter and the majority of preexisting uses
were signed. And consistency is good.)

Improve the names of some members of struct quotactl_args. These are
effectively function parameter names, but since they need to be
described with the same names in the man page the choices do matter.
Some.

Split out a do_sys_quotactl for compat_netbsd32.

Change the syscall API for quotas over to the new non-proplib one.

   - struct vfs_quotactl_args -> struct quotactl_args
   - add sys/stdint.h to sys/quotactl.h for clean userland build
   - install sys/quotactl.h in /usr/include
   - update set lists for same
   - add new marshalling code in libquota
   - add new unmarshalling code in vfs_syscalls.c
   - discard proplib interpreter code in vfs_quotactl.c
   - add dispatching code for the 14 quotactl ops in vfs_quotactl.c
   - mark the proplib quotactl syscall obsolete
   - add a new syscall number for the new quotactl syscall
   - change the name of the syscall to __quotactl()
   - remove the decl of the old quotactl from quota/quotaprop.h
   - add a decl of the new quotactl to sys/quotactl.h
   - update the libc build
   - update ktruss
   - remove proplib marshalling code from libquota
   - update copy of syscall table in gdb ppc sources
   - hack rumphijack to accomodate new quotactl name (as I recall,
     pooka wanted such a name change to simplify something, but I
     don't really see what/how)

This change appears to require a kernel version bump for rumpish
reasons.

Add vfs_quotactl() in between the syscall and VFS_QUOTACTL. Call it
from the COMPAT_50 code as well as the current sys_quotactl instead
of going directly to VFS_QUOTACTL. Doesn't actually do anything yet.

fix an indent an unwarp a short line.

- collect the long (and sometimes incomplete) lists of basic flags into
  the header file and use that.
- sort the list of basic flags
- add MNT_RELATIME, ST_RELATIME
- mask all the op flags, for symmetry.

The real bit difference is (which is harmless):
    - mount was missing MNT_EXTATTR
    - update sets MNT_RDONLY twice
    - ops also could or in MNT_GETARGS, but this is impossible because the
      code would have chosen to do getargs then.

Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock.  Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.

Pull up following revision(s) (requested by manu in ticket #1658):
	sys/rump/include/rump/rump_syscalls.h: revision 1.52 via patch
	sys/kern/init_sysent.c: revision 1.257 via patch
	sys/rump/include/rump/rumpvnode_if.h: revision 1.12 via patch
	lib/libc/sys/Makefile.inc: revision 1.208 via patch
	sys/sys/syscallargs.h: revision 1.227 via patch
	sys/kern/kern_exec.c: revision 1.317 via patch
	sys/rump/librump/rumpkern/rump_syscalls.c: revision 1.74 via patch
	include/limits.h: revision 1.30 via patch
	sys/kern/syscalls.master: revision 1.251 via patch
	sys/sys/vnode_if.h: revision 1.83 via patch
	sys/sys/fcntl.h: revision 1.40 via patch
	sys/sys/fcntl.h: revision 1.41 via patch
	sys/kern/vfs_syscalls.c: revision 1.433 via patch
	sys/rump/librump/rumpvfs/rumpvnode_if.c: revision 1.11 via patch
	sys/kern/syscalls.c: revision 1.248 via patch
	sys/sys/syscall.h: revision 1.244 via patch
	lib/libc/sys/link.2: revision 1.25 via patch
	include/unistd.h: revision 1.127 via patch
	distrib/sets/lists/comp/mi: revision 1.1659 via patch
	sys/sys/stat.h: revision 1.61 via patch
First stage of support for Extended API set 2. Most of the think is
unimplemented, except enough of linkat(2) to hardlink to a symlink.
Everything new in headers is guarded #ifdef _INCOMPLETE_XOPEN_C063 since
some software (e.g.: xcvs in our own tree) will assume they can use openat(2)
when AT_FDCWD is defined. _INCOMPLETE_XOPEN_C063 will go away once support
will be completed.
regen
improve comment about AT_* defines: they are not only used by linkat(2)
Add macros to hide OpenGroup extened API set 2 from GNU configure. This
is a temporary  workaround until the implementation is completed.

Remove return statement which can't be reached.

When both nanoseconds fields of futimens/utimensat call are set
to UTIMES_NOW, act as if NULL is passed to second argument, i.e.,
do same permission check and set exactly same value to both access
and modification time.

Fix utimes/futimes after utimensat/futimens addition

Missing bit in previous commit: do_sys_utimens prototype in the right
place.

add missing prototype

Add futimens(2) and part of utimnsat(2)

First stage of support for Extended API set 2. Most of the think is
unimplemented, except enough of linkat(2) to hardlink to a symlink.

Everything new in headers is guarded #ifdef _INCOMPLETE_XOPEN_C063 since
some software (e.g.: xcvs in our own tree) will assume they can use openat(2)
when AT_FDCWD is defined. _INCOMPLETE_XOPEN_C063 will go away once support
will be completed.

Make sure to not overwrite error if it already is EEXISTS - hopefully
will fix > 100 failing fs tests in my last test run.

Return EINVAL when trying to create a device node with "rdev == VNOVAL".

Fixes PR #45111 "tmpfs panic with mknod(2)".

Catchup with rmind-uvmplock merge.

Add mount -o extattr option to enable extended attributs (corrently only
for UFS1).
Remove kernel option for EA backing store autocreation and do it by
default. Add a sysctl so that autocreated attriutr size can be modified.

Welcome to 5.99.53!  Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
  New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
  the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
  Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
  kernel-lock on some ports).  Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

sync with head

Fix build; p was not used, but l was passed to kauth.  Use curlwp directly.

l isn't used.  nuke it.

do_sys_rename: Kill an unused variable.

Sync with HEAD.

Don't directly call sys_sync() from random bits of code, instead
  add do_sys_sync() that takes an 'lwp' (for l_cred) as an argument.
Explicitly pass &lwp0 rather than NULL and expecting sys_sync to
  substitute some random lwp.

Fix type in comment
(before I replace the 'l' with 'curlwp')

sync with head

sys_link: prevent hard links on directories (cross-mount operations are
already prevented).  File systems are no longer responsible to check this.
Clean up and add asserts (note that dvp == vp cannot happen in vop_link).

OK dholland@

sync with head

- Add O_CLOEXEC to open(2)
- Add fd_set_exclose() to encapsulate uses of FIO{,N}CLEX, O_CLOEXEC, F{G,S}ETFD
- Add a pipe1() function to allow passing flags to the fd's that pipe(2)
  opens to ease implementation of linux pipe2(2)
- Factor out fp handling code from open(2) and fhopen(2)

Remove unused M_MOUNT.

Split off parts of vfs_subr.c into vfs_vnode.c and vfs_mount.c modules.

No functional change.  Discussed on tech-kern@.

Pull up following revision(s) (requested by dholland in ticket #1567):
	sys/kern/vfs_syscalls.c: revision 1.415 via patch
Check for bogus flags to access() up front. Otherwise we end up
calling VOP_ACCESS with flags 0 and something asserts deep in the
bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
earlier relative to the suggested patch.)
Pullup candidate.

Pull up following revision(s) (requested by dholland in ticket #1567):
	sys/kern/vfs_syscalls.c: revision 1.415 via patch
Check for bogus flags to access() up front. Otherwise we end up
calling VOP_ACCESS with flags 0 and something asserts deep in the
bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
earlier relative to the suggested patch.)
Pullup candidate.

Pull up following revision(s) (requested by dholland in ticket #1567):
	sys/kern/vfs_syscalls.c: revision 1.415 via patch
Check for bogus flags to access() up front. Otherwise we end up
calling VOP_ACCESS with flags 0 and something asserts deep in the
bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
earlier relative to the suggested patch.)
Pullup candidate.

Pull up following revision(s) (requested by dholland in ticket #1417):
	sys/kern/vfs_syscalls.c: revision 1.415 via patch
Check for bogus flags to access() up front. Otherwise we end up
calling VOP_ACCESS with flags 0 and something asserts deep in the
bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
earlier relative to the suggested patch.)
Pullup candidate.

Pull up following revision(s) (requested by dholland in ticket #1417):
	sys/kern/vfs_syscalls.c: revision 1.415 via patch
Check for bogus flags to access() up front. Otherwise we end up
calling VOP_ACCESS with flags 0 and something asserts deep in the
bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
earlier relative to the suggested patch.)
Pullup candidate.

prevent cross-mount operations.

merge the bouyer-quota2 branch. This adds a new on-disk format
to store disk quota usage and limits, integrated with ffs
metadata. Usage is checked by fsck_ffs (no more quotacheck)
and is covered by the WAPBL journal. Enabled with kernel
option QUOTA2 (added where QUOTA was enabled in kernel config files),
turned on with tunefs(8) on a per-filesystem
basis. mount_mfs(8) can also turn quotas on.

See http://mail-index.netbsd.org/tech-kern/2011/02/19/msg010025.html
for details.

sync with head

Sync with HEAD

Revert previous, which doesn't cover all the cases if F_OK isn't 0,
and just CTASSERT that it is, as that's not remotely likely to change.
Per source-changes-d; ok by Christos.

don't depend on F_OK being 0.

Check for bogus flags to access() up front. Otherwise we end up
calling VOP_ACCESS with flags 0 and something asserts deep in the
bowels of kauth. PR 44648 from Taylor Campbell. (I moved the check
earlier relative to the suggested patch.)

Pullup candidate.

Implement COMPAT_50 quotactl(2)

Remove debug printf

Snapshot of work in progress on a modernised disk quota system:
- new quotactl syscall (versionned for backward compat), which takes
  as parameter a path to a mount point, and a prop_dictionary
  (in plistref format) describing commands and arguments.
  For each command, status and data are returned as a prop_dictionary.
  quota commands features will be added to take advantage of this,
  exporting quota data or getting quota commands as plists.

- new on disk-format storage (all 64bit wide), integrated to metadata for
  ffs (and playing nicely with wapbl).
  Quotas are enabled on a ffs filesystem via superblock flags.
  tunefs(8) can enable or disable quotas.
  On a quota-enabled filesystem, fsck_ffs(8) will track per-uid/gid
  block and inode usages, and will check and update quotas in Pass 6.
  quota usage and limits are stored in unliked files (one for users,
  one for groups)l fsck_ffs(8) will create the files if needed, or
  free them if needed. This means that after enabling or disabling
  quotas on a filesystem; a fsck_ffs(8) run is required.
  quotacheck(8) is not needed any more, on a unclean shutdown
  fsck or journal replay will take care of fixing quotas.
  newfs(8) can create a ready-to-mount quota-enabled filesystem
  (superblock flags are set and quota inodes are created).
  Other new features or semantic changes:
  - default quota datas, applied to users or groups which don't already
    have a quota entry
  - per-user/group grace time (instead of a filesystem global one)
  - 0 really means "nothing allowed at all", not "no limit".
    If you want "no limit", set the limit to UQUAD_MAX (tools will
    understand "unlimited" and "-")

  A quota file is structured as follow:
  it starts with a header, containing a few per-filesystem values,
  and the default quota limits.
  Quota entries are linked together as a simple list, each entry has a
  pointer (as an offset withing the file) to the next.
  The header has a pointer to a list of free quota entries, and
  a hash table of in-use entries. The size of the hash table depends
  on the filesystem block size (header+hash table should fit in the
  first block). The file is not sparse and is a multiple of
  filesystem block size (when the free quota entry list is empty a new
  filesystem block is allocated). quota entries to not cross
  filesystem block boundaries.

  In memory, the kernel keeps a cache of recently used quota entries
  as a reference to the block number, and offset withing the block.
  The quota entry itself is keept in the buf cache.

fsck_ffs(8), tunefs(8) and newfs(8) supports are completed (with
related atf tests :)
The kernel can update disk usage and report it via quotactl(2).

Todo: enforce quotas limits (limits are not checked by kernel yet)
      update repquota, edquota and rpc.rquotad to the new world
      implement compat_50_quotactl ioctl.
      update quotactl(2) man page

fsck_ffs required fixes so that allocating new blocks or inodes will
properly update the superblock and cg sumaries. This was not an issue up
to now because superblock and cg sumaries check happened last, but now
allocations or frees can happen in pass 6.

allow file system to decide if it can be downgraded from r/w to r/o

Remove remaining references to SAVESTART.

Remove the special refcount behavior (adding an extra reference to the
parent dir) associated with SAVESTART in relookup().

Check all call sites to make sure that SAVESTART wasn't set while
calling relookup(); if it was, adjust the refcount behavior. Remove
related references to SAVESTART.

The only code that was reaching the extra ref was msdosfs_rename,
where the refcount behavior was already fairly broken and/or gross;
repair it.

Add a dummy 4th argument to relookup to make sure code that hasn't
been inspected won't compile. (This will go away next time the
relookup semantics change, which they will.)

Remove unused nameidata field ni_startdir.

Abolish struct componentname's cn_pnbuf. Use the path buffer in the
pathbuf object passed to namei as work space instead. (For now a pnbuf
pointer appears in struct nameidata, to support certain unclean things
that haven't been fixed yet, but it will be going away in the future.)

This removes the need for the SAVENAME and HASBUF namei flags.

Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Propagate MNT_XIP in mount flags.

Sync with HEAD (-D20101022).

sync with head

locking changes

Update the rest of the kernel to conform to the module subsystem's new
locking protocol.

Sync with HEAD.

sync with head.

sync with head

Enable kernel-internal symlink creation with do_sys_symlink().
I did this a while ago already, but can't remember why i didn't
commit it then.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

When mounting a file system re-lookup and lock the directory we mount on
after the file system is setup by VFS_MOUNT().  This way recursive vnode
locks are no longer needed here and mounts on null mounts no longer fail
as described in PR #43439 (mount_null panic: lockdebug_wantlock: locking
against myself).

Based on a proposal from  and
Reviewed by: David A. Holland <dholland@netbsd.org>

Remove the "xip" option from mount_ffs(8) for simplicity.

Sync with HEAD.

sync to netbsd-5

Change struct uvm_object::vmobjlock to be dynamically allocated with
mutex_obj_alloc().  It allows us to share the locks among UVM objects.

sync with head

remove redundant checks of PK_MARKER.

More bits to pass the new XIP mount option correctly.

Pull up following revision(s) (requested by pooka in ticket #1289):
	sys/sys/namei.src: revision 1.14
	sys/kern/vfs_syscalls.c: revision 1.401
	sys/nfs/nfs_serv.c: revision 1.149
	sys/sys/namei.h: regen
Define namei flag INRENAME and set it if a lookup operation is part
of rename.  This helps with building better asserts for rename in
the DELETE lookup ... the RENAME lookup is quite obviously a part
of rename.

Fix reference counting for vfsops in mount.  Otherwise it's possible
(for an unprivileged user) to force vfs modules to remain loaded
forever.  Also, it's possible for an admin with fat fingers to have
to curse out loud (a lot) and reboot.

.. or at least fix things as much as seems to be possible without
involving 1000 zorkmids.  do_sys_mount() takes either struct vfsops
(which hopefully came properly referenced) or a userspace string
for file system type.  The standard in-kernel calling convention
of "do_sys_mount(l, vfs_getopsbyname("nfs"), NULL," is not to be
considered healthy, kosher, or even tasty (although if vfs_getopsbyname()
fails the whole thing *currently* fails without the program counter
pointing to hyperspace).

The VATTR_NULL/VREF/VHOLD/HOLDRELE() macros lost their will to live
years ago when the kernel was modified to not alter ABI based on
DIAGNOSTIC, and now just call the respective function interfaces
(in lowercase).  Plenty of mix'n match upper/lowercase has creeped
into the tree since then.  Nuke the macros and convert all callsites
to lowercase.

no functional change

Define namei flag INRENAME and set it if a lookup operation is part
of rename.  This helps with building better asserts for rename in
the DELETE lookup ... the RENAME lookup is quite obviously a part
of rename.

Pull up the following revisions(s) (requested by martin in ticket #1200):
	sys/kern/vfs_syscalls.c:	revision 1.400

Use the kernel space version of the vfs name, not the original userspace
pointer. Avoids crashes on archs with completely separate userspace VA.

Pull up the following revisions(s) (requested by martin in ticket #1200):
	sys/kern/vfs_syscalls.c:	revision 1.400

Use the kernel space version of the vfs name, not the original userspace
pointer. Avoids crashes on archs with completely separate userspace VA.

Use the kernel space version of the vfs name, not the original userspace
pointer. Avoids crashes on archs with completely separate userspace VA.

sync with head.

Add enum uio_seg argument to do_sys_mknod and do_sys_mkdir so these functions
can be called from kernel, too.

Change needed for zfs device node creation, until we have propoer devfs.

Oked by ad@.

Add a note to change_root() that the callers need to authorize the operation.
As requested by elad@.

As discussed on tech-kern:

Factor out common code of chroot-like syscalls into change_root() and export
that function for use in other parts of the kernel.
Rename change_dir() to chdir_lookup() as the latter describes better what
the function does.  While there, move the namei_data initialisation into
chdir_lookup(), too.  And export chdir_lookup().

Sync with HEAD.

sync with head.

expose mkdir to in-kernel consumers

Pull up following revision(s) (requested by rmind in ticket #841):
	sys/kern/vfs_syscalls.c: revision 1.392
do_sys_utimes: fix a bug introduced by rev.1.367.
VA_UTIMES_NULL is in va_vaflags, not va_flags.

Pull up following revision(s) (requested by rmind in ticket #841):
	sys/kern/vfs_syscalls.c: revision 1.392
do_sys_utimes: fix a bug introduced by rev.1.367.
VA_UTIMES_NULL is in va_vaflags, not va_flags.

Convert 67 namei call sites to use namei_simple, in these functions:

check_console, veriexecclose, veriexec_delete, veriexec_file_add,
emul_find_root, coff_load_shlib (sh3 version), coff_load_shlib,
compat_20_sys_statfs, compat_20_netbsd32_statfs,
ELFNAME2(netbsd32,probe_noteless), darwin_sys_statfs,
ibcs2_sys_statfs, ibcs2_sys_statvfs, linux_sys_uselib,
osf1_sys_statfs, sunos_sys_statfs, sunos32_sys_statfs,
ultrix_sys_statfs, do_sys_mount, fss_create_files (3 of 4),
adosfs_mount, cd9660_mount, coda_ioctl, coda_mount, ext2fs_mount,
ffs_mount, filecore_mount, hfs_mount, lfs_mount, msdosfs_mount,
ntfs_mount, sysvbfs_mount, udf_mount, union_mount, sys_chflags,
sys_lchflags, sys_chmod, sys_lchmod, sys_chown, sys_lchown,
sys___posix_chown, sys___posix_lchown, sys_link, do_sys_pstatvfs,
sys_quotactl, sys_revoke, sys_truncate, do_sys_utimes, sys_extattrctl,
sys_extattr_set_file, sys_extattr_set_link, sys_extattr_get_file,
sys_extattr_get_link, sys_extattr_delete_file,
sys_extattr_delete_link, sys_extattr_list_file, sys_extattr_list_link,
sys_setxattr, sys_lsetxattr, sys_getxattr, sys_lgetxattr,
sys_listxattr, sys_llistxattr, sys_removexattr, sys_lremovexattr

All have been scrutinized (several times, in fact) and compile-tested,
but not all have been explicitly tested in action.

XXX: While I haven't (intentionally) changed the use or nonuse of
XXX: TRYEMULROOT in any of these places, I'm not convinced all the
XXX: uses are correct; an audit might be desirable.

lock vnode when calling VOP_GETATTR because there's no reasonable way for
an implementation of VOP_GETATTR to prevent the vnode from being revoked.

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

sync with head.

Move dovfsusermount from vfs_syscalls.c to param.c: secmodel bsd44
depends on it and we can't isolate it in vfs.
(no, it doesn't really belong in param.c, but I couldn't figure out
a better place for it)

Extract common code from vfs_rootmountalloc(9) and mount_domount() into
a new struct mount-allocation routine, vfs_mountalloc(9).  Documentation
updates will follow.

Attention: Synchronization Oversight Committee!  In mount_domount(),
I postpone the call mutex_enter(&mp->mnt_updating) until right before
the VFS_MOUNT(9) call because (1) that looks to me like the earliest
possible opportunity for mp to become visible to any other LWP, because
it was just kmem_zalloc(9)'d and (2) it made extracting the common code
much easier.  Tell me if my reasoning is faulty.

Sync with HEAD.

do_sys_utimes: fix a bug introduced by rev.1.367.
VA_UTIMES_NULL is in va_vaflags, not va_flags.

do_sys_unlink: remove an unused credential.

Sync with HEAD.

Fix some comments.

PR kern/26878 FFSv2 + softdep = livelock (no free ram)
PR kern/16942 panic with softdep and quotas
PR kern/19565 panic: softdep_write_inodeblock: indirect pointer #1 mismatch
PR kern/26274 softdep panic: allocdirect_merge: ...
PR kern/26374 Long delay before non-root users can write to softdep partitions
PR kern/28621 1.6.x "vp != NULL" panic in ffs_softdep.c:4653 while unmounting a softdep (+quota) filesystem
PR kern/29513 FFS+Softdep panic with unfsck-able file-corruption
PR kern/31544 The ffs softdep code appears to fail to write dirty bits to disk
PR kern/31981 stopping scsi disk can cause panic (softdep)
PR kern/32116 kernel panic in softdep (assertion failure)
PR kern/32532 softdep_trackbufs deadlock
PR kern/37191 softdep: locking against myself
PR kern/40474 Kernel panic after remounting raid root with softdep

Retire softdep, pass 2. As discussed and later formally announced on the
mailing lists.

Pull up following revision(s) (requested by enami in ticket #435):
	sys/kern/vfs_subr.c: revision 1.368
	sys/kern/vfs_syscalls.c: revision 1.385
Make revoke(2) works as before:
- vfs_syscalls.c rev. 1.342 fails to invert condition correcly when
  then-clause and else-clause is swapped.  Since then, revoke(2) fails
  if it is issued by file owner.
- Probably since rev. 1.160 of genfs_vnops.c, revoke(2) fails if it is
  applied to non-device file and drops kernel into ddb.

Simplify the code; we already have a hint to decide which string to copy.
(And at least gcc generates better code.)

from enami: Only apply rootdir changes if the chroot dir != /

PR/40634: Christoph Badura: "chroot / /sbin/mount" shows only / as mounted

Make revoke(2) works as before:
- vfs_syscalls.c rev. 1.342 fails to invert condition correcly when
  then-clause and else-clause is swapped.  Since then, revoke(2) fails
  if it is issued by file owner.
- Probably since rev. 1.160 of genfs_vnops.c, revoke(2) fails if it is
  applied to non-device file and drops kernel into ddb.

Sync with HEAD.

Sync with HEAD.

malloc -> kmem_alloc.

merge christos-time_t

merge with head.

Pull up following revision(s) (requested by elad in ticket #188):
	sys/kern/vfs_syscalls.c: revision 1.382
Fix length passed to strlcpy(): we used to get names one character shorter
than reality.
Should be pulled up to netbsd-5.

Fix length passed to strlcpy(): we used to get names one character shorter
than reality.

Should be pulled up to netbsd-5.

Update haad-dm branch to haad-dm-base2.

merge with head.

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

<sys/buf.h> police

Fix a comment.

- Move some more compat code into sys/compat.
- Split 4.3BSD ifioctl stuff into its own file.
- Remove some ifdefs that include small fragments of vfs compat code
  which are difficult to relocate elsewhere.

Remove LKMs and switch to the module framework, pass 1.

Proposed on tech-kern@.

fix fhstat
make major and minor ull

Sync with head.

- Be clear about whether module load is explicit or system initiated (auto).
- Require that module_lock is held to autoload, so that any preconditions
  can be safely checked.

Sync with HEAD.

Sync with HEAD.

Sync with HEAD.

Fix typo in comment.

PR kern/39307 (mfs will sometimes panic at umount time)

Change dounmount() so that it never drops the caller provided reference.
Garbage collecting 'struct mount' is up to the caller.

Merge in changes between wrstuden-revivesa-base-2 and
wrstuden-revivesa-base-3.

PR kern/30525 remounting ffs read-only (mount -ur) does not sync metadata

Prevent r/w to r/o downgrade until such time as someone has verified all
the relevant file system code.

PR kern/39307 mfs will sometimes panic at umount time

Don't drop reference to the mount if VFS_START() fails - that's for unmount
to do.

Sync with wrstuden-revivesa-base-2.

Replace the fss unmount hook with a vfs_hook.

fssvar.h:       struct device * -> device_t.
fss.c:          establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c:    destroy cow handlers on unmount as fstrans_unmount() will be
                called before vfs_hooks.

Merge the simonb-wapbl branch.  From the original branch commit:

   Add Wasabi System's WAPBL (Write Ahead Physical Block Logging)
   journaling code.  Originally written by Darrin B. Jewell while
   at Wasabi and updated to -current by Antti Kantee, Andy Doran,
   Greg Oster and Simon Burge.

OK'd by core@, releng@.

"mount -u -o log" works now - remove the code that explicity disabled
this.

Sync with HEAD.

Sync with head.

Nothing uses getsock/getvnode any more.

Sync w/ -current. 34 merge conflicts to follow.

Sync with head.

set mtime/atime properly, not backwards.

PR/38942: Pedro F. Giffuni: no support for birthtime in utimes(2).

sync with head.

Initial commit of Wasabi System's WAPBL (Write Ahead Physical Block
Logging) journaling code.  Originally written by Darrin B. Jewell
while at Wasabi and updated to -current by Antti Kantee, Andy Doran,
Greg Oster and Simon Burge.

Still a number of issues - look in doc/BRANCHES for "simonb-wapbl"
for more info.

In mount_domount() there is no need to initialise "mp" if the first time
we use it we set it.

sync with head

Sync with HEAD.

More fixes needed in the error paths for the chroot code to work.

PR/38745: Kouichirou Hiratsuka: chroot(8) can leak information of outside of
chrooted directory

Ignore return from module_load() and just try vfsop lookup again.

If autoloading a module, don't consider the current working directory.

Don't try to load a module while holding a vnode lock.

If mount fails because the needed file system code isn't in kernel, try
to autoload with the needed vfsops.

sync with head.

sync with head.

Per discussion with ad, remove most of the #include <sys/sa.h> lines
as they were including sa.h just for the type(s) needed for syscallargs.h.

Instead, create a new file, sys/satypes.h, which contains just the
types needed for syscallargs.h. Yes, there's only one now, but that
may change and it's probably more likely to change if it'd be difficult
to handle. :-)

Per discussion with matt at n dot o, add an include of satypes.h to
sigtypes.h. Upcall handlers are kinda signal handlers, and signalling
is the header file that's already included for syscallargs.h that
closest matches SA.

This shaves about 3000 lines off of the diff of the branch relative
to the base. That also represents about 18% of the total before this
checkin.

I think this reduction is very good thing.

Initial checkin of re-adding SA. Everything except kern_sa.c
compiles in GENERIC for i386. This is still a work-in-progress, but
this checkin covers most of the mechanical work (changing signalling
to be able to accomidate SA's process-wide signalling and re-adding
includes of sys/sa.h and savar.h). Subsequent changes will be much
more interesting.

Also, kern_sa.c has received partial cleanup. There's still more
to do, though.

sys_unmount: drop ref to root dir before dounmount(), otherwise we'll
always get EBUSY.

PR kern/38141 lookup/vfs_busy acquire rwlock recursively

Simplify the mount locking. Remove all the crud to deal with recursion on
the mount lock, and crud to deal with unmount as another weirdo lock.

Hopefully this will once and for all fix the deadlocks with this. With this
commit there are two locks on each mount:

- krwlock_t mnt_unmounting. This is used to prevent unmount across critical
  sections like getnewvnode(). It's only ever read locked with rw_tryenter(),
  and is only ever write locked in dounmount(). A write hold can't be taken
  on this lock if the current LWP could hold a vnode lock.

- kmutex_t mnt_updating. This is taken by threads updating the mount, for
  example when going r/o -> r/w, and is only present to serialize updates.
  In order to take this lock, a read hold must first be taken on
  mnt_unmounting, and the two need to be held across the operation.

One effect of this change: previously if an unmount failed, we would make a
half hearted attempt to back out of it gracefully, but that was unlikely to
work in a lot of cases. Now while an unmount that will be aborted is in
progress, new file operations within the mount will fail instead of being
delayed. That is unlikely to be a problem though, because if the admin
requests unmount of a file system then s(he) has made a decision to deny
access to the resource.

Make this build again.

PR kern/38141 lookup/vfs_busy acquire rwlock recursively

- sys_sync: acquire a write lock on the mount since the operation modifies
  the mount structure.
- sys_fchdir: use vfs_trybusy(). If an unmount is in progress, just fail it.

Fix a couple of problems with checkdirs():

- vnode and cwd locks were being taken with proc_lock held, which is bad
  because proc_lock can only be held for a short period of time.

- Processes could have continually forked and escaped notice, keeping
  a reference to the old directory on top of which a new mount exists.

PR kern/38135 vfs_busy/vfs_trybusy confusion

The previous fix worked, but it opened a window where mounts could have
disappeared from mountlist while the caller was traversing it using
vfs_trybusy(). Fix that.

kern/38135 vfs_busy/vfs_trybusy confusion

The symptom was that sometimes file systems would occasionally not appear
in output from 'df' or 'mount' if the system was busy. Resolution:

- Make mount locks work somewhat like vm_map locks.
- vfs_trybusy() now only fails if the mount is gone, or if someone is
  unmounting the file system. Simple contention on mnt_lock doesn't
  cause it to fail.
- vfs_busy() will wait even if the file system is being unmounted.

Ignore processes with PK_MARKER set.

Remove clause 3 and 4 from TNF licenses

Before allowing rmdir to progess into the netherhells called VFS,
check if no filesystem is mounted on this node. This can happen
for null mounts on top of null mounts.

Network protocol interrupts can now block on locks, so merge the globals
proclist_mutex and proclist_lock into a single adaptive mutex (proc_lock).
Implications:

- Inspecting process state requires thread context, so signals can no longer
  be sent from a hardware interrupt handler. Signal activity must be
  deferred to a soft interrupt or kthread.

- As the proc state locking is simplified, it's now safe to take exit()
  and wait() out from under kernel_lock.

- The system spends less time at IPL_SCHED, and there is less lock activity.

Sync with HEAD.

Welcome to the time_t=long long dev_t=uint64_t branch.

Yet another rename workaround - this time check for . and .. early because
relookup() objects to being asked to handle them.