Fix info leaks.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.18.2; 1.18.4;
Fail, don't panic, on bad dirents from file system.

Controllable via puffs from userland.

From Ilja Van Sprundel.

branches: 1.17.6;
avoid the shadow

we have space for one more.

fix size computation

branches: 1.14.2;
convert strcpy to a bounded copy to avoid compiler warnings, although the
reclen test prevents overflow.

branches: 1.13.8; 1.13.12; 1.13.14; 1.13.22; 1.13.28; 1.13.30; 1.13.32; 1.13.34; 1.13.38;
Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock. Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.

recent versions of linux (which we now claim to be) supply a BSD-style
d_type value in getdents() results, after the d_name field.
make our emulation do the same. fixes part of PR 43695.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.10.2;
When implementing "read directory", when there are too many empty entries
in a row, and we need to try to read the next block, and have passed a
non-NULL cookie pointer to VOP_READDIR, ensure that we free the cookie
buffer before re-doing VOP_READDIR, so that we don't leak memory.
This fix is similar to nfs_serv.c revisions 1.115 + 1.124.

This should fix the long-standing problem observed by e.g. using Linux-
emulated programs to take backup of servers, which is one of the problems
which were reported in PR#42661.

Thanks to pooka@ for the hints for traversing the VOP* layer.

branches: 1.9.2;
Make compat linux/linux32 getdents(2) fail with ENOTDIR instead of
EINVAL when file descriptor does not refer to a directory.

branches: 1.8.2;
s/syscallcarg/syscallarg/ in comments.

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.6.2; 1.6.4; 1.6.8;
Make linux32 getdents(2) do its own job instead of calling the
corresponding compat linux function, where struct dirent members types
differs.

branches: 1.5.6; 1.5.10; 1.5.12; 1.5.16;
Add readdir syscall.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.3.4;
ANSIfy most of the function definitions in sys/compat (but not ndis).
All by the magic of sed ...

branches: 1.2.18; 1.2.20; 1.2.26; 1.2.28;
Merge newlock2 to head.

branches: 1.1.2; 1.1.10; 1.1.16; 1.1.20; 1.1.22;
Add initial (but unfinished) COMPAT_LINUX32 for amd64. This is good enough so
that the i386 license manager part of amd64 version of Fluent works.

While I'm here, add SysV IPC to COMPAT_LINUX/amd64

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.18.2;
Fail, don't panic, on bad dirents from file system.

Controllable via puffs from userland.

From Ilja Van Sprundel.

branches: 1.17.6;
avoid the shadow

we have space for one more.

fix size computation

branches: 1.14.2;
convert strcpy to a bounded copy to avoid compiler warnings, although the
reclen test prevents overflow.

branches: 1.13.8; 1.13.12; 1.13.14; 1.13.22; 1.13.28; 1.13.30; 1.13.32; 1.13.34; 1.13.38;
Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock. Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.

recent versions of linux (which we now claim to be) supply a BSD-style
d_type value in getdents() results, after the d_name field.
make our emulation do the same. fixes part of PR 43695.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.10.2;
When implementing "read directory", when there are too many empty entries
in a row, and we need to try to read the next block, and have passed a
non-NULL cookie pointer to VOP_READDIR, ensure that we free the cookie
buffer before re-doing VOP_READDIR, so that we don't leak memory.
This fix is similar to nfs_serv.c revisions 1.115 + 1.124.

This should fix the long-standing problem observed by e.g. using Linux-
emulated programs to take backup of servers, which is one of the problems
which were reported in PR#42661.

Thanks to pooka@ for the hints for traversing the VOP* layer.

branches: 1.9.2;
Make compat linux/linux32 getdents(2) fail with ENOTDIR instead of
EINVAL when file descriptor does not refer to a directory.

branches: 1.8.2;
s/syscallcarg/syscallarg/ in comments.

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.6.2; 1.6.4; 1.6.8;
Make linux32 getdents(2) do its own job instead of calling the
corresponding compat linux function, where struct dirent members types
differs.

branches: 1.5.6; 1.5.10; 1.5.12; 1.5.16;
Add readdir syscall.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.3.4;
ANSIfy most of the function definitions in sys/compat (but not ndis).
All by the magic of sed ...

branches: 1.2.18; 1.2.20; 1.2.26; 1.2.28;
Merge newlock2 to head.

branches: 1.1.2; 1.1.10; 1.1.16; 1.1.20; 1.1.22;
Add initial (but unfinished) COMPAT_LINUX32 for amd64. This is good enough so
that the i386 license manager part of amd64 version of Fluent works.

While I'm here, add SysV IPC to COMPAT_LINUX/amd64

Fail, don't panic, on bad dirents from file system.

Controllable via puffs from userland.

From Ilja Van Sprundel.

avoid the shadow

we have space for one more.

fix size computation

branches: 1.14.2;
convert strcpy to a bounded copy to avoid compiler warnings, although the
reclen test prevents overflow.

branches: 1.13.30; 1.13.34;
Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock. Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.

recent versions of linux (which we now claim to be) supply a BSD-style
d_type value in getdents() results, after the d_name field.
make our emulation do the same. fixes part of PR 43695.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.10.2;
When implementing "read directory", when there are too many empty entries
in a row, and we need to try to read the next block, and have passed a
non-NULL cookie pointer to VOP_READDIR, ensure that we free the cookie
buffer before re-doing VOP_READDIR, so that we don't leak memory.
This fix is similar to nfs_serv.c revisions 1.115 + 1.124.

This should fix the long-standing problem observed by e.g. using Linux-
emulated programs to take backup of servers, which is one of the problems
which were reported in PR#42661.

Thanks to pooka@ for the hints for traversing the VOP* layer.

branches: 1.9.2;
Make compat linux/linux32 getdents(2) fail with ENOTDIR instead of
EINVAL when file descriptor does not refer to a directory.

branches: 1.8.2;
s/syscallcarg/syscallarg/ in comments.

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.6.2; 1.6.4; 1.6.8;
Make linux32 getdents(2) do its own job instead of calling the
corresponding compat linux function, where struct dirent members types
differs.

branches: 1.5.6; 1.5.10; 1.5.12; 1.5.16;
Add readdir syscall.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.3.4;
ANSIfy most of the function definitions in sys/compat (but not ndis).
All by the magic of sed ...

branches: 1.2.18; 1.2.20; 1.2.26; 1.2.28;
Merge newlock2 to head.

branches: 1.1.2; 1.1.10; 1.1.16; 1.1.20; 1.1.22;
Add initial (but unfinished) COMPAT_LINUX32 for amd64. This is good enough so
that the i386 license manager part of amd64 version of Fluent works.

While I'm here, add SysV IPC to COMPAT_LINUX/amd64

avoid the shadow

we have space for one more.

fix size computation

convert strcpy to a bounded copy to avoid compiler warnings, although the
reclen test prevents overflow.

Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock. Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.

recent versions of linux (which we now claim to be) supply a BSD-style
d_type value in getdents() results, after the d_name field.
make our emulation do the same. fixes part of PR 43695.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.10.2;
When implementing "read directory", when there are too many empty entries
in a row, and we need to try to read the next block, and have passed a
non-NULL cookie pointer to VOP_READDIR, ensure that we free the cookie
buffer before re-doing VOP_READDIR, so that we don't leak memory.
This fix is similar to nfs_serv.c revisions 1.115 + 1.124.

This should fix the long-standing problem observed by e.g. using Linux-
emulated programs to take backup of servers, which is one of the problems
which were reported in PR#42661.

Thanks to pooka@ for the hints for traversing the VOP* layer.

branches: 1.9.2;
Make compat linux/linux32 getdents(2) fail with ENOTDIR instead of
EINVAL when file descriptor does not refer to a directory.

branches: 1.8.2;
s/syscallcarg/syscallarg/ in comments.

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.6.2; 1.6.4; 1.6.8;
Make linux32 getdents(2) do its own job instead of calling the
corresponding compat linux function, where struct dirent members types
differs.

branches: 1.5.6; 1.5.10; 1.5.12; 1.5.16;
Add readdir syscall.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.3.4;
ANSIfy most of the function definitions in sys/compat (but not ndis).
All by the magic of sed ...

branches: 1.2.18; 1.2.20; 1.2.26; 1.2.28;
Merge newlock2 to head.

branches: 1.1.2; 1.1.10; 1.1.16; 1.1.20; 1.1.22;
Add initial (but unfinished) COMPAT_LINUX32 for amd64. This is good enough so
that the i386 license manager part of amd64 version of Fluent works.

While I'm here, add SysV IPC to COMPAT_LINUX/amd64

convert strcpy to a bounded copy to avoid compiler warnings, although the
reclen test prevents overflow.

Change the vnode locking protocol of VOP_GETATTR() to request at least
a shared lock. Make all calls outside of file systems respect it.

The calls from file systems need review.

No objections from tech-kern.

recent versions of linux (which we now claim to be) supply a BSD-style
d_type value in getdents() results, after the d_name field.
make our emulation do the same. fixes part of PR 43695.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.10.2;
When implementing "read directory", when there are too many empty entries
in a row, and we need to try to read the next block, and have passed a
non-NULL cookie pointer to VOP_READDIR, ensure that we free the cookie
buffer before re-doing VOP_READDIR, so that we don't leak memory.
This fix is similar to nfs_serv.c revisions 1.115 + 1.124.

This should fix the long-standing problem observed by e.g. using Linux-
emulated programs to take backup of servers, which is one of the problems
which were reported in PR#42661.

Thanks to pooka@ for the hints for traversing the VOP* layer.

branches: 1.9.2;
Make compat linux/linux32 getdents(2) fail with ENOTDIR instead of
EINVAL when file descriptor does not refer to a directory.

branches: 1.8.2;
s/syscallcarg/syscallarg/ in comments.

Make the emulations, exec formats, coredump, NFS, and the NFS server
into modules. By and large this commit:

- shuffles header files and ifdefs
- splits code out where necessary to be modular
- adds module glue for each of the components
- adds/replaces hooks for things that can be installed at runtime

branches: 1.6.2; 1.6.4; 1.6.8;
Make linux32 getdents(2) do its own job instead of calling the
corresponding compat linux function, where struct dirent members types
differs.

branches: 1.5.6; 1.5.10; 1.5.12; 1.5.16;
Add readdir syscall.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.3.4;
ANSIfy most of the function definitions in sys/compat (but not ndis).
All by the magic of sed ...

branches: 1.2.18; 1.2.20; 1.2.26; 1.2.28;
Merge newlock2 to head.

branches: 1.1.2; 1.1.10; 1.1.16; 1.1.20; 1.1.22;
Add initial (but unfinished) COMPAT_LINUX32 for amd64. This is good enough so
that the i386 license manager part of amd64 version of Fluent works.

While I'm here, add SysV IPC to COMPAT_LINUX/amd64