Move the rnd_add_uint32 outside the lock and get rid of dk_done1() suggested
by riastradh@

dk_start(): retry device-dependent start() routine later, also when it
returns ENOMEM in addition to EAGAIN.

Device-dependent start() routine may allocate buffer directly, or via
bus_dma(9) API (some implementations for bus_dma(9) like alpha allocate
memory internally).

If these attempts fail with ENOMEM, this is not a disk error, therefore
we must retry later, as already done for EAGAIN.

branches: 1.112.8;
Add a flag to dk_dump for virtual disk devices.

If a disk is backed by a physical medium other than itself, such as
cgd(4), then it passes DK_DUMP_RECURSIVE to disable the recursion
detection for dk_dump.

If, however, a device represents a physical medium on its own, such
as wd(4), then it passes 0 instead.

With this, I can now dump to dk on cgd on dk on wd.

Drop now unused dk_lookup function.

Bail when dkdriver hasn't been initialized. This can happen when
attachment failed or when it hasn't finished yet.

branches: 1.109.2;
Store a reference to the CPU that submitted the I/O request with the
request itself.

wether -> whether

Add a disk ioctl DIOCRMWEDGES to remove all wedges of a given disk
(if not busy).

fix the disklabel sanity check coversion for case when both disklabel
and disk geometry are > DEV_BSIZE, such as fictitious cd(4) disklabel

still part of PR kern/53833

convert the sector counts for label sanity checks to use same unit (DEV_BSIZE),
so that the check is meaningful if disklabel sector size and disk geometry
sector size differ - for example 512 disklabel vs 2048 for sparc cd(4)

conversion assumes that the sector sizes are multiples of DEV_BSIZE (512)

fixes kern/53833 by Andreas Gustafsson

Note: the checks are executed #ifdef DIAGNOSTIC, that's why nothing
is printed by 8.0 kernel, or anything built from release branches

rnd_add_uint32() doens't support concurent calls for the same rnd_source,
call it with dksc->sc_iolock held.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.102.2;
Support dump on wedges.

branches: 1.101.2;
add KASSERT() just before setting sc_deferred, to ensure this does
not trigger problem in PR kern/52769

Use driver specific label code as fallback. This fixes the UDF label for CDs.

Initialize error also in the case where len=0, which just succeeds.
while here, assert that the len is indeed non-negative. this is already
confirmed by sys_fdiscard, but let's be sure.

reported by: GCC, but with different compile flags

validate length for discard operation and split operation when byte length
doesn't fit into 'int'.

branches: 1.97.2;
do not attach nvme ld as randomness source - device is too fast, it overwhelms
the rndq handling code, and causes system crashes; gathering rnd there is
also bad idea from performance perspective

branches: 1.96.4;
Enhance disk metrics by calculating a weighted sum that is incremented
by the number of concurrent I/O requests. Also introduce a new disk_wait()
function to measure requests waiting in a bufq.
iostat -y now reports data about waiting and active requests.

So far only drivers using dksubr and dk, ccd, wd and xbd collect data about
waiting requests.

pacify disklabel validation message

branches: 1.94.2;
Fix race condition in dksubr, where a dk_start from another thread
or interrupt was ignored while the queue was processed.

Bump kernel revision for changed dk_softc.

invoke optional d_label callback to give the driver the possibility
to adjust the label with driver specific data.

Extend dkdriver interface with a d_firstopen function. This is called
by dk_open() for the first opener and mirrors the use of the d_lastclose
callback.

Bump kernel version for the interface change.

revert 1.90 of dksubr.c and change sc_deferred back to simple pointer; the
global sc_busy flag guards against race so it's not actually necessary, and
this place is unlikely to need to be parallelized in near future

discussed with mlelstv@

change sc_deferred to TAILQ (reusing bufq b_actq) to avoid possible buf leak
for MPSAFE drivers

Set b_resid in error path.

branches: 1.88.2;
CID 1362902: forward null
CID 136290{3,4}: missing break

Avoid NULL deref in case no bufq has been set.

erase dangling pointer to prevent reuse

support deferral of diskstart to a separate thread.

more sanity checks

Replace DIOCGPART -> DIOCGPARTINFO which returns the data needed instead of
pointers.

bounds check requires consistent units, i.e. DEV_BSIZE.

remove extra quote

fix this differently.

fix build failure on i386.

fix constant name

Fix dumping code (dk_dump):
- set DKF_TAKEDUMP on attach, otherwise we can never dump
- add DKF_DUMP debugging
- use __func__ instead of hard-coding names
- only allow dumps on swap partitions

move entropy gathering into dksubr.

Prevent race condition where two threads can defer a buffer.

Make dksubr use a spin-mutex again, since some drivers still call dk_done
from hardware interrupt. Instead, release mutex while calling start routine.

The buffer peek/use/get sequence which can no longer be atomic. So consume
the buffer directly and on error privately save and retry the buffer later.
The dk_drain function is used to flush such a deferred buffer together with
the buffer queue.
Adjust drivers to use dk_drain.

Fix an error path where dk_done was called while the lock was already held.

An adaptive mutex is sufficient, the data structures are accessed
by regular threads and by the biodone softint.

This allows diskstart routines to sleep (like cgd).

only touch b_resid on error.

Two changes to the dksubr interface.

- d_diskstart callback now processes a single buffer only.
The new wrapper function dk_start processes the queue,
performs other buffer handling and also provides locking
for the the data structures.

- add d_discard callback to handle device specific function inside
the new dk_discard helper function.

Replace splbio with mutex to protect queue and disk structure.
Refactor common code in dk_strategy and dk_discard into dk_translate.

Adjust and simplify ld(4), cgd(4) and xbd(4) drivers accordingly.

ld(4) now becomes MP_SAFE.

Bump kernel version.

require write access to delete a wedge

move FWRITE checks to a common place

fix diskerr message, it needs the driver name, not the device unit name.

Trailing whitespace.

Handle non-DEV_BSIZE sectors.

remove duplicate variable initializations.

Mark disklabel only invalid on the last close. Existing openers might see
temporarily invalid data while it is re-read.

CID 1297229: use strlcpy

CID 1297229: Memory - illegal accesses (BUFFER_SIZE_WARNING)

warn about labels only when built with DIAGNOSTIC

Merge dk_intf and dkdriver interfaces.
Merge common disk driver functionality in ld.c with dksubr.c.
Adjust the two previous users of dk_intf (cgd and xbd) to
the changes.

bump kernel version to 7.99.14

correctly return -1 on error in dk_size

make more drivers use disk_ioctl, and add a dev parameter to it so that
we can merge the "easy" disklabel ioctls to it. Ultimately all this will
go do dk_ioctl once all the drivers have been converted.

Centralize wedge ioctls in disk_ioctl.

Implement DIOCGMEDIASIZE and DIOCGSECTORSIZE from FreeBSD.

align dk_strategy with checks from ld.c

branches: 1.54.2;
support DIOCMWEDGES ioctl.

No longer warn about differences bewteen disk size and total sector count
in disklabel when the latter is just clamped to the maximum.

clamp total number of sectors to UINT32_MAX instead of providing the
lower 32bit of the 64bit number.

branches: 1.51.2;
Change dk_lookup() to return an anonymous vnode not associated with
any file system. Change all consumers of dk_lookup() to get the
device from "v_rdev" instead of VOP_GETATTR() as specfs does not
support VOP_GETATTR(). Devices obtained with dk_lookup() will no
longer disappear on forced unmounts.

Fix for PR kern/48849 (root mirror raid fails on shutdown)

Welcome to 6.99.44

As proposed in
https://mail-index.netbsd.org/tech-kern/2014/05/21/msg017098.html
remove dk_start() and dk_iodone() from dksubr.c and move the related code
to the underlying driver.
This increase complexity only marginally: the underlying drivers have
to do the while() loop themselves, but this can now be done properly with
bufq_peek()/bufq_get(), removing the buffer from the queue at the right time.
This handle both the recursion and reordering issues (the reordering
issue is described here:
https://mail-index.netbsd.org/tech-kern/2014/05/19/msg017089.html
the recursion isssue is PR #25240).

Difference with the patch posted to tech-kern@: KASSERT() that the
buffer we remove with bufq_get() is the same as the one we bufq_peek()'d
just before.
Hopefully this will allow more disk drivers to use dksubr.c

branches: 1.49.2;
Make dksubr.c into a module, and make the cgd and dm modules depend on
it.

Now that cgd is completely modularized, descend into modules/cgd to
actually create the module.

branches: 1.48.2;
eliminate sc_size and fix printf formats

eliminate dk_geom

phase 1 of disk geometry cleanup:
- centralize the geometry -> plist code so that we don't have
n useless copies of it.

branches: 1.45.2;
Fix 32/64 bit int truncation issue.

Revert a few lines of accidental commit.

Modify dksubr.c to add a function that sets the disk properties in
the drvctl framework. And call this new functionality from cgd(4),
the consumer of dksubr.c. We do this to allow gpt(8) to be able
to label cgd(4) disks. We also add in some DIOCGSECTORSIZE logic
and we ensure that the WEDGE ioctls are not called on either
uninitialised disks or disks which have not been opened for write
access.

branches: 1.42.8; 1.42.12; 1.42.14;
Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.40.4; 1.40.6;
g/c BUFQ_FOO() macros and use bufq_foo() directly.

make this compile

merge christos-time_t

branches: 1.37.8;
Remove clause 3 and 4 from TNF licenses

branches: 1.36.2; 1.36.4;
Allow to pass device_xname() to dk_sc_init() without build error
OK joerg

branches: 1.35.2;
Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

branches: 1.34.6;
Remove code to prevent multiple open of block devices; it's no longer
needed.

Remove cn_lwp from struct componentname. curlwp should be used
from on. The NDINIT() macro no longer takes the lwp parameter and
associates the credentials of the calling thread with the namei
structure.

branches: 1.32.2;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

branches: 1.31.4; 1.31.6; 1.31.12; 1.31.14;
It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.

Replace some uses of lockmgr().

branches: 1.29.2;
Change dk_lookup() to accept an additional argument of the type enum uio_seg
that tells whether the given path is in user space or kernel space, so it
can tell NDINIT().

While the raidframe calls were ok, both ccd(4) and cgd(4) were passing
pointers to user space data, which leads to strange error on i386, as
reported by Jukka Salmi on current-users.

The issue has been there since last august, I'm actually a bit surprised
that no one in the meantime has used ccd(4) or cgd(4) on an arch where it
would have simply faulted.

branches: 1.28.2; 1.28.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2; 1.27.4; 1.27.8;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.25.2; 1.25.4;
typo in debug printf

Add horrible hack for wedges. Why is the block device of the wedges in use?

- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

integrate kauth.

branches: 1.21.4; 1.21.6; 1.21.8; 1.21.10; 1.21.12;
- add ioctls to set/get disk bufq strategy.
- implement them for some drivers.

More ktrace-lwp merge.

merge ktrace-lwp.

dksubr: do b_blkno -> b_rawblkno translation earlier so that bufq can uses it.

- change the way to specify a bufq strategy. (by string rather than by number)
- rather than embedding bufq_state in driver softc,
have a pointer to the former.
- move bufq related functions from kern/subr_disk.c to kern/subr_bufq.c.
- rename method to strategy for consistency.
- move some definitions which don't need to be exposed to the rest of kernel
from sys/bufq.h to sys/bufq_impl.h.
(is it better to move it to kern/ or somewhere?)
- fix some obvious breakage in dev/qbus/ts.c. (not tested)

add wedge support to xbd and cgd.

branches: 1.15.2;
constification fallout

move buffer queue related stuffs from buf.h to their own header, bufq.h.

Sprinkle static in a few places.

Redo dk_start(). If di->di_diskstart() runs synchronous its biodone() will
call dk_start() via dk_iodone() before the buffer gets removed from queue.

Approved by: Roland Dowdeswell <elric@netbsd.org>

Fixes PR #25240

branches: 1.11.2;
Modified the dksubr routines to:

o expect the disk's start routine to return an int. If the
int is non-zero, we enqueue the request and try again
later.
o have a dk_start() routine which runs the request queue.
o have a dk_iodone() function which should be called by the
driver using the framwork from its iodone. dk_iodone will
retry the queue since presumably further progress may be
possible once a request is complete. It is required that
the underlying driver have the resources to keep at least
one transaction in flight at any time.

Modified cgd to:

o be able to keep one transaction in flight at any time
(almost) by keeping a buffer of size MAXPHYS in its softc
and use it.

We still need to make the cgd_cbufpool per device rather than global
and provide a low water mark for it.

Addresses PR: kern/24715
(at least according to the submitter.)

add missing __KERNEL_RCSID()

branches: 1.9.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

make this compile again.

Change bounds_check_with_label() to take a pointer to the disk structure,
rather than the label itself. This paves the way for some future changes.

Change return type of readdisklabel() to const char *
I hope I've found all the correct places!

Memset disklabel area to zero before beginning when constructing default
labels. Problem noticed and tested by dan@.

branches: 1.3.2;
We need to pass the dk_softc, not the osc.

We need to do biodone() if strategy is called on an unconfigured device.

A slight abstraction for disks. This is mainly [right now] in
support of the cryptographic disk which I'll be checking in shortly.

dk_start(): retry device-dependent start() routine later, also when it
returns ENOMEM in addition to EAGAIN.

Device-dependent start() routine may allocate buffer directly, or via
bus_dma(9) API (some implementations for bus_dma(9) like alpha allocate
memory internally).

If these attempts fail with ENOMEM, this is not a disk error, therefore
we must retry later, as already done for EAGAIN.

Add a flag to dk_dump for virtual disk devices.

If a disk is backed by a physical medium other than itself, such as
cgd(4), then it passes DK_DUMP_RECURSIVE to disable the recursion
detection for dk_dump.

If, however, a device represents a physical medium on its own, such
as wd(4), then it passes 0 instead.

With this, I can now dump to dk on cgd on dk on wd.

Drop now unused dk_lookup function.

Bail when dkdriver hasn't been initialized. This can happen when
attachment failed or when it hasn't finished yet.

branches: 1.109.2;
Store a reference to the CPU that submitted the I/O request with the
request itself.

wether -> whether

Add a disk ioctl DIOCRMWEDGES to remove all wedges of a given disk
(if not busy).

fix the disklabel sanity check coversion for case when both disklabel
and disk geometry are > DEV_BSIZE, such as fictitious cd(4) disklabel

still part of PR kern/53833

convert the sector counts for label sanity checks to use same unit (DEV_BSIZE),
so that the check is meaningful if disklabel sector size and disk geometry
sector size differ - for example 512 disklabel vs 2048 for sparc cd(4)

conversion assumes that the sector sizes are multiples of DEV_BSIZE (512)

fixes kern/53833 by Andreas Gustafsson

Note: the checks are executed #ifdef DIAGNOSTIC, that's why nothing
is printed by 8.0 kernel, or anything built from release branches

rnd_add_uint32() doens't support concurent calls for the same rnd_source,
call it with dksc->sc_iolock held.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.102.2;
Support dump on wedges.

branches: 1.101.2;
add KASSERT() just before setting sc_deferred, to ensure this does
not trigger problem in PR kern/52769

Use driver specific label code as fallback. This fixes the UDF label for CDs.

Initialize error also in the case where len=0, which just succeeds.
while here, assert that the len is indeed non-negative. this is already
confirmed by sys_fdiscard, but let's be sure.

reported by: GCC, but with different compile flags

validate length for discard operation and split operation when byte length
doesn't fit into 'int'.

branches: 1.97.2;
do not attach nvme ld as randomness source - device is too fast, it overwhelms
the rndq handling code, and causes system crashes; gathering rnd there is
also bad idea from performance perspective

branches: 1.96.4;
Enhance disk metrics by calculating a weighted sum that is incremented
by the number of concurrent I/O requests. Also introduce a new disk_wait()
function to measure requests waiting in a bufq.
iostat -y now reports data about waiting and active requests.

So far only drivers using dksubr and dk, ccd, wd and xbd collect data about
waiting requests.

pacify disklabel validation message

branches: 1.94.2;
Fix race condition in dksubr, where a dk_start from another thread
or interrupt was ignored while the queue was processed.

Bump kernel revision for changed dk_softc.

invoke optional d_label callback to give the driver the possibility
to adjust the label with driver specific data.

Extend dkdriver interface with a d_firstopen function. This is called
by dk_open() for the first opener and mirrors the use of the d_lastclose
callback.

Bump kernel version for the interface change.

revert 1.90 of dksubr.c and change sc_deferred back to simple pointer; the
global sc_busy flag guards against race so it's not actually necessary, and
this place is unlikely to need to be parallelized in near future

discussed with mlelstv@

change sc_deferred to TAILQ (reusing bufq b_actq) to avoid possible buf leak
for MPSAFE drivers

Set b_resid in error path.

branches: 1.88.2;
CID 1362902: forward null
CID 136290{3,4}: missing break

Avoid NULL deref in case no bufq has been set.

erase dangling pointer to prevent reuse

support deferral of diskstart to a separate thread.

more sanity checks

Replace DIOCGPART -> DIOCGPARTINFO which returns the data needed instead of
pointers.

bounds check requires consistent units, i.e. DEV_BSIZE.

remove extra quote

fix this differently.

fix build failure on i386.

fix constant name

Fix dumping code (dk_dump):
- set DKF_TAKEDUMP on attach, otherwise we can never dump
- add DKF_DUMP debugging
- use __func__ instead of hard-coding names
- only allow dumps on swap partitions

move entropy gathering into dksubr.

Prevent race condition where two threads can defer a buffer.

Make dksubr use a spin-mutex again, since some drivers still call dk_done
from hardware interrupt. Instead, release mutex while calling start routine.

The buffer peek/use/get sequence which can no longer be atomic. So consume
the buffer directly and on error privately save and retry the buffer later.
The dk_drain function is used to flush such a deferred buffer together with
the buffer queue.
Adjust drivers to use dk_drain.

Fix an error path where dk_done was called while the lock was already held.

An adaptive mutex is sufficient, the data structures are accessed
by regular threads and by the biodone softint.

This allows diskstart routines to sleep (like cgd).

only touch b_resid on error.

Two changes to the dksubr interface.

- d_diskstart callback now processes a single buffer only.
The new wrapper function dk_start processes the queue,
performs other buffer handling and also provides locking
for the the data structures.

- add d_discard callback to handle device specific function inside
the new dk_discard helper function.

Replace splbio with mutex to protect queue and disk structure.
Refactor common code in dk_strategy and dk_discard into dk_translate.

Adjust and simplify ld(4), cgd(4) and xbd(4) drivers accordingly.

ld(4) now becomes MP_SAFE.

Bump kernel version.

require write access to delete a wedge

move FWRITE checks to a common place

fix diskerr message, it needs the driver name, not the device unit name.

Trailing whitespace.

Handle non-DEV_BSIZE sectors.

remove duplicate variable initializations.

Mark disklabel only invalid on the last close. Existing openers might see
temporarily invalid data while it is re-read.

CID 1297229: use strlcpy

CID 1297229: Memory - illegal accesses (BUFFER_SIZE_WARNING)

warn about labels only when built with DIAGNOSTIC

Merge dk_intf and dkdriver interfaces.
Merge common disk driver functionality in ld.c with dksubr.c.
Adjust the two previous users of dk_intf (cgd and xbd) to
the changes.

bump kernel version to 7.99.14

correctly return -1 on error in dk_size

make more drivers use disk_ioctl, and add a dev parameter to it so that
we can merge the "easy" disklabel ioctls to it. Ultimately all this will
go do dk_ioctl once all the drivers have been converted.

Centralize wedge ioctls in disk_ioctl.

Implement DIOCGMEDIASIZE and DIOCGSECTORSIZE from FreeBSD.

align dk_strategy with checks from ld.c

branches: 1.54.2;
support DIOCMWEDGES ioctl.

No longer warn about differences bewteen disk size and total sector count
in disklabel when the latter is just clamped to the maximum.

clamp total number of sectors to UINT32_MAX instead of providing the
lower 32bit of the 64bit number.

branches: 1.51.2;
Change dk_lookup() to return an anonymous vnode not associated with
any file system. Change all consumers of dk_lookup() to get the
device from "v_rdev" instead of VOP_GETATTR() as specfs does not
support VOP_GETATTR(). Devices obtained with dk_lookup() will no
longer disappear on forced unmounts.

Fix for PR kern/48849 (root mirror raid fails on shutdown)

Welcome to 6.99.44

As proposed in
https://mail-index.netbsd.org/tech-kern/2014/05/21/msg017098.html
remove dk_start() and dk_iodone() from dksubr.c and move the related code
to the underlying driver.
This increase complexity only marginally: the underlying drivers have
to do the while() loop themselves, but this can now be done properly with
bufq_peek()/bufq_get(), removing the buffer from the queue at the right time.
This handle both the recursion and reordering issues (the reordering
issue is described here:
https://mail-index.netbsd.org/tech-kern/2014/05/19/msg017089.html
the recursion isssue is PR #25240).

Difference with the patch posted to tech-kern@: KASSERT() that the
buffer we remove with bufq_get() is the same as the one we bufq_peek()'d
just before.
Hopefully this will allow more disk drivers to use dksubr.c

branches: 1.49.2;
Make dksubr.c into a module, and make the cgd and dm modules depend on
it.

Now that cgd is completely modularized, descend into modules/cgd to
actually create the module.

branches: 1.48.2;
eliminate sc_size and fix printf formats

eliminate dk_geom

phase 1 of disk geometry cleanup:
- centralize the geometry -> plist code so that we don't have
n useless copies of it.

branches: 1.45.2;
Fix 32/64 bit int truncation issue.

Revert a few lines of accidental commit.

Modify dksubr.c to add a function that sets the disk properties in
the drvctl framework. And call this new functionality from cgd(4),
the consumer of dksubr.c. We do this to allow gpt(8) to be able
to label cgd(4) disks. We also add in some DIOCGSECTORSIZE logic
and we ensure that the WEDGE ioctls are not called on either
uninitialised disks or disks which have not been opened for write
access.

branches: 1.42.8; 1.42.12; 1.42.14;
Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.40.4; 1.40.6;
g/c BUFQ_FOO() macros and use bufq_foo() directly.

make this compile

merge christos-time_t

branches: 1.37.8;
Remove clause 3 and 4 from TNF licenses

branches: 1.36.2; 1.36.4;
Allow to pass device_xname() to dk_sc_init() without build error
OK joerg

branches: 1.35.2;
Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

branches: 1.34.6;
Remove code to prevent multiple open of block devices; it's no longer
needed.

Remove cn_lwp from struct componentname. curlwp should be used
from on. The NDINIT() macro no longer takes the lwp parameter and
associates the credentials of the calling thread with the namei
structure.

branches: 1.32.2;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

branches: 1.31.4; 1.31.6; 1.31.12; 1.31.14;
It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.

Replace some uses of lockmgr().

branches: 1.29.2;
Change dk_lookup() to accept an additional argument of the type enum uio_seg
that tells whether the given path is in user space or kernel space, so it
can tell NDINIT().

While the raidframe calls were ok, both ccd(4) and cgd(4) were passing
pointers to user space data, which leads to strange error on i386, as
reported by Jukka Salmi on current-users.

The issue has been there since last august, I'm actually a bit surprised
that no one in the meantime has used ccd(4) or cgd(4) on an arch where it
would have simply faulted.

branches: 1.28.2; 1.28.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2; 1.27.4; 1.27.8;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.25.2; 1.25.4;
typo in debug printf

Add horrible hack for wedges. Why is the block device of the wedges in use?

- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

integrate kauth.

branches: 1.21.4; 1.21.6; 1.21.8; 1.21.10; 1.21.12;
- add ioctls to set/get disk bufq strategy.
- implement them for some drivers.

More ktrace-lwp merge.

merge ktrace-lwp.

dksubr: do b_blkno -> b_rawblkno translation earlier so that bufq can uses it.

- change the way to specify a bufq strategy. (by string rather than by number)
- rather than embedding bufq_state in driver softc,
have a pointer to the former.
- move bufq related functions from kern/subr_disk.c to kern/subr_bufq.c.
- rename method to strategy for consistency.
- move some definitions which don't need to be exposed to the rest of kernel
from sys/bufq.h to sys/bufq_impl.h.
(is it better to move it to kern/ or somewhere?)
- fix some obvious breakage in dev/qbus/ts.c. (not tested)

add wedge support to xbd and cgd.

branches: 1.15.2;
constification fallout

move buffer queue related stuffs from buf.h to their own header, bufq.h.

Sprinkle static in a few places.

Redo dk_start(). If di->di_diskstart() runs synchronous its biodone() will
call dk_start() via dk_iodone() before the buffer gets removed from queue.

Approved by: Roland Dowdeswell <elric@netbsd.org>

Fixes PR #25240

branches: 1.11.2;
Modified the dksubr routines to:

o expect the disk's start routine to return an int. If the
int is non-zero, we enqueue the request and try again
later.
o have a dk_start() routine which runs the request queue.
o have a dk_iodone() function which should be called by the
driver using the framwork from its iodone. dk_iodone will
retry the queue since presumably further progress may be
possible once a request is complete. It is required that
the underlying driver have the resources to keep at least
one transaction in flight at any time.

Modified cgd to:

o be able to keep one transaction in flight at any time
(almost) by keeping a buffer of size MAXPHYS in its softc
and use it.

We still need to make the cgd_cbufpool per device rather than global
and provide a low water mark for it.

Addresses PR: kern/24715
(at least according to the submitter.)

add missing __KERNEL_RCSID()

branches: 1.9.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

make this compile again.

Change bounds_check_with_label() to take a pointer to the disk structure,
rather than the label itself. This paves the way for some future changes.

Change return type of readdisklabel() to const char *
I hope I've found all the correct places!

Memset disklabel area to zero before beginning when constructing default
labels. Problem noticed and tested by dan@.

branches: 1.3.2;
We need to pass the dk_softc, not the osc.

We need to do biodone() if strategy is called on an unconfigured device.

A slight abstraction for disks. This is mainly [right now] in
support of the cryptographic disk which I'll be checking in shortly.

Add a flag to dk_dump for virtual disk devices.

If a disk is backed by a physical medium other than itself, such as
cgd(4), then it passes DK_DUMP_RECURSIVE to disable the recursion
detection for dk_dump.

If, however, a device represents a physical medium on its own, such
as wd(4), then it passes 0 instead.

With this, I can now dump to dk on cgd on dk on wd.

Drop now unused dk_lookup function.

Bail when dkdriver hasn't been initialized. This can happen when
attachment failed or when it hasn't finished yet.

Store a reference to the CPU that submitted the I/O request with the
request itself.

wether -> whether

Add a disk ioctl DIOCRMWEDGES to remove all wedges of a given disk
(if not busy).

fix the disklabel sanity check coversion for case when both disklabel
and disk geometry are > DEV_BSIZE, such as fictitious cd(4) disklabel

still part of PR kern/53833

convert the sector counts for label sanity checks to use same unit (DEV_BSIZE),
so that the check is meaningful if disklabel sector size and disk geometry
sector size differ - for example 512 disklabel vs 2048 for sparc cd(4)

conversion assumes that the sector sizes are multiples of DEV_BSIZE (512)

fixes kern/53833 by Andreas Gustafsson

Note: the checks are executed #ifdef DIAGNOSTIC, that's why nothing
is printed by 8.0 kernel, or anything built from release branches

rnd_add_uint32() doens't support concurent calls for the same rnd_source,
call it with dksc->sc_iolock held.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.102.2;
Support dump on wedges.

branches: 1.101.2;
add KASSERT() just before setting sc_deferred, to ensure this does
not trigger problem in PR kern/52769

Use driver specific label code as fallback. This fixes the UDF label for CDs.

Initialize error also in the case where len=0, which just succeeds.
while here, assert that the len is indeed non-negative. this is already
confirmed by sys_fdiscard, but let's be sure.

reported by: GCC, but with different compile flags

validate length for discard operation and split operation when byte length
doesn't fit into 'int'.

branches: 1.97.2;
do not attach nvme ld as randomness source - device is too fast, it overwhelms
the rndq handling code, and causes system crashes; gathering rnd there is
also bad idea from performance perspective

branches: 1.96.4;
Enhance disk metrics by calculating a weighted sum that is incremented
by the number of concurrent I/O requests. Also introduce a new disk_wait()
function to measure requests waiting in a bufq.
iostat -y now reports data about waiting and active requests.

So far only drivers using dksubr and dk, ccd, wd and xbd collect data about
waiting requests.

pacify disklabel validation message

branches: 1.94.2;
Fix race condition in dksubr, where a dk_start from another thread
or interrupt was ignored while the queue was processed.

Bump kernel revision for changed dk_softc.

invoke optional d_label callback to give the driver the possibility
to adjust the label with driver specific data.

Extend dkdriver interface with a d_firstopen function. This is called
by dk_open() for the first opener and mirrors the use of the d_lastclose
callback.

Bump kernel version for the interface change.

revert 1.90 of dksubr.c and change sc_deferred back to simple pointer; the
global sc_busy flag guards against race so it's not actually necessary, and
this place is unlikely to need to be parallelized in near future

discussed with mlelstv@

change sc_deferred to TAILQ (reusing bufq b_actq) to avoid possible buf leak
for MPSAFE drivers

Set b_resid in error path.

branches: 1.88.2;
CID 1362902: forward null
CID 136290{3,4}: missing break

Avoid NULL deref in case no bufq has been set.

erase dangling pointer to prevent reuse

support deferral of diskstart to a separate thread.

more sanity checks

Replace DIOCGPART -> DIOCGPARTINFO which returns the data needed instead of
pointers.

bounds check requires consistent units, i.e. DEV_BSIZE.

remove extra quote

fix this differently.

fix build failure on i386.

fix constant name

Fix dumping code (dk_dump):
- set DKF_TAKEDUMP on attach, otherwise we can never dump
- add DKF_DUMP debugging
- use __func__ instead of hard-coding names
- only allow dumps on swap partitions

move entropy gathering into dksubr.

Prevent race condition where two threads can defer a buffer.

Make dksubr use a spin-mutex again, since some drivers still call dk_done
from hardware interrupt. Instead, release mutex while calling start routine.

The buffer peek/use/get sequence which can no longer be atomic. So consume
the buffer directly and on error privately save and retry the buffer later.
The dk_drain function is used to flush such a deferred buffer together with
the buffer queue.
Adjust drivers to use dk_drain.

Fix an error path where dk_done was called while the lock was already held.

An adaptive mutex is sufficient, the data structures are accessed
by regular threads and by the biodone softint.

This allows diskstart routines to sleep (like cgd).

only touch b_resid on error.

Two changes to the dksubr interface.

- d_diskstart callback now processes a single buffer only.
The new wrapper function dk_start processes the queue,
performs other buffer handling and also provides locking
for the the data structures.

- add d_discard callback to handle device specific function inside
the new dk_discard helper function.

Replace splbio with mutex to protect queue and disk structure.
Refactor common code in dk_strategy and dk_discard into dk_translate.

Adjust and simplify ld(4), cgd(4) and xbd(4) drivers accordingly.

ld(4) now becomes MP_SAFE.

Bump kernel version.

require write access to delete a wedge

move FWRITE checks to a common place

fix diskerr message, it needs the driver name, not the device unit name.

Trailing whitespace.

Handle non-DEV_BSIZE sectors.

remove duplicate variable initializations.

Mark disklabel only invalid on the last close. Existing openers might see
temporarily invalid data while it is re-read.

CID 1297229: use strlcpy

CID 1297229: Memory - illegal accesses (BUFFER_SIZE_WARNING)

warn about labels only when built with DIAGNOSTIC

Merge dk_intf and dkdriver interfaces.
Merge common disk driver functionality in ld.c with dksubr.c.
Adjust the two previous users of dk_intf (cgd and xbd) to
the changes.

bump kernel version to 7.99.14

correctly return -1 on error in dk_size

make more drivers use disk_ioctl, and add a dev parameter to it so that
we can merge the "easy" disklabel ioctls to it. Ultimately all this will
go do dk_ioctl once all the drivers have been converted.

Centralize wedge ioctls in disk_ioctl.

Implement DIOCGMEDIASIZE and DIOCGSECTORSIZE from FreeBSD.

align dk_strategy with checks from ld.c

branches: 1.54.2;
support DIOCMWEDGES ioctl.

No longer warn about differences bewteen disk size and total sector count
in disklabel when the latter is just clamped to the maximum.

clamp total number of sectors to UINT32_MAX instead of providing the
lower 32bit of the 64bit number.

branches: 1.51.2;
Change dk_lookup() to return an anonymous vnode not associated with
any file system. Change all consumers of dk_lookup() to get the
device from "v_rdev" instead of VOP_GETATTR() as specfs does not
support VOP_GETATTR(). Devices obtained with dk_lookup() will no
longer disappear on forced unmounts.

Fix for PR kern/48849 (root mirror raid fails on shutdown)

Welcome to 6.99.44

As proposed in
https://mail-index.netbsd.org/tech-kern/2014/05/21/msg017098.html
remove dk_start() and dk_iodone() from dksubr.c and move the related code
to the underlying driver.
This increase complexity only marginally: the underlying drivers have
to do the while() loop themselves, but this can now be done properly with
bufq_peek()/bufq_get(), removing the buffer from the queue at the right time.
This handle both the recursion and reordering issues (the reordering
issue is described here:
https://mail-index.netbsd.org/tech-kern/2014/05/19/msg017089.html
the recursion isssue is PR #25240).

Difference with the patch posted to tech-kern@: KASSERT() that the
buffer we remove with bufq_get() is the same as the one we bufq_peek()'d
just before.
Hopefully this will allow more disk drivers to use dksubr.c

branches: 1.49.2;
Make dksubr.c into a module, and make the cgd and dm modules depend on
it.

Now that cgd is completely modularized, descend into modules/cgd to
actually create the module.

branches: 1.48.2;
eliminate sc_size and fix printf formats

eliminate dk_geom

phase 1 of disk geometry cleanup:
- centralize the geometry -> plist code so that we don't have
n useless copies of it.

branches: 1.45.2;
Fix 32/64 bit int truncation issue.

Revert a few lines of accidental commit.

Modify dksubr.c to add a function that sets the disk properties in
the drvctl framework. And call this new functionality from cgd(4),
the consumer of dksubr.c. We do this to allow gpt(8) to be able
to label cgd(4) disks. We also add in some DIOCGSECTORSIZE logic
and we ensure that the WEDGE ioctls are not called on either
uninitialised disks or disks which have not been opened for write
access.

branches: 1.42.8; 1.42.12; 1.42.14;
Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.40.4; 1.40.6;
g/c BUFQ_FOO() macros and use bufq_foo() directly.

make this compile

merge christos-time_t

branches: 1.37.8;
Remove clause 3 and 4 from TNF licenses

branches: 1.36.2; 1.36.4;
Allow to pass device_xname() to dk_sc_init() without build error
OK joerg

branches: 1.35.2;
Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

branches: 1.34.6;
Remove code to prevent multiple open of block devices; it's no longer
needed.

Remove cn_lwp from struct componentname. curlwp should be used
from on. The NDINIT() macro no longer takes the lwp parameter and
associates the credentials of the calling thread with the namei
structure.

branches: 1.32.2;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

branches: 1.31.4; 1.31.6; 1.31.12; 1.31.14;
It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.

Replace some uses of lockmgr().

branches: 1.29.2;
Change dk_lookup() to accept an additional argument of the type enum uio_seg
that tells whether the given path is in user space or kernel space, so it
can tell NDINIT().

While the raidframe calls were ok, both ccd(4) and cgd(4) were passing
pointers to user space data, which leads to strange error on i386, as
reported by Jukka Salmi on current-users.

The issue has been there since last august, I'm actually a bit surprised
that no one in the meantime has used ccd(4) or cgd(4) on an arch where it
would have simply faulted.

branches: 1.28.2; 1.28.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.27.2; 1.27.4; 1.27.8;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.25.2; 1.25.4;
typo in debug printf

Add horrible hack for wedges. Why is the block device of the wedges in use?

- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

integrate kauth.

branches: 1.21.4; 1.21.6; 1.21.8; 1.21.10; 1.21.12;
- add ioctls to set/get disk bufq strategy.
- implement them for some drivers.

More ktrace-lwp merge.

merge ktrace-lwp.

dksubr: do b_blkno -> b_rawblkno translation earlier so that bufq can uses it.

- change the way to specify a bufq strategy. (by string rather than by number)
- rather than embedding bufq_state in driver softc,
have a pointer to the former.
- move bufq related functions from kern/subr_disk.c to kern/subr_bufq.c.
- rename method to strategy for consistency.
- move some definitions which don't need to be exposed to the rest of kernel
from sys/bufq.h to sys/bufq_impl.h.
(is it better to move it to kern/ or somewhere?)
- fix some obvious breakage in dev/qbus/ts.c. (not tested)

add wedge support to xbd and cgd.

branches: 1.15.2;
constification fallout

move buffer queue related stuffs from buf.h to their own header, bufq.h.

Sprinkle static in a few places.

Redo dk_start(). If di->di_diskstart() runs synchronous its biodone() will
call dk_start() via dk_iodone() before the buffer gets removed from queue.

Approved by: Roland Dowdeswell <elric@netbsd.org>

Fixes PR #25240

branches: 1.11.2;
Modified the dksubr routines to:

o expect the disk's start routine to return an int. If the
int is non-zero, we enqueue the request and try again
later.
o have a dk_start() routine which runs the request queue.
o have a dk_iodone() function which should be called by the
driver using the framwork from its iodone. dk_iodone will
retry the queue since presumably further progress may be
possible once a request is complete. It is required that
the underlying driver have the resources to keep at least
one transaction in flight at any time.

Modified cgd to:

o be able to keep one transaction in flight at any time
(almost) by keeping a buffer of size MAXPHYS in its softc
and use it.

We still need to make the cgd_cbufpool per device rather than global
and provide a low water mark for it.

Addresses PR: kern/24715
(at least according to the submitter.)

add missing __KERNEL_RCSID()

branches: 1.9.2;
Back out the lwp/ktrace changes. They contained a lot of colateral damage,
and need to be examined and discussed more.

Pass lwp pointers throughtout the kernel, as required, so that the lwpid can
be inserted into ktrace records. The general change has been to replace
"struct proc *" with "struct lwp *" in various function prototypes, pass
the lwp through and use l_proc to get the process pointer when needed.

Bump the kernel rev up to 1.6V

make this compile again.

Change bounds_check_with_label() to take a pointer to the disk structure,
rather than the label itself. This paves the way for some future changes.

Change return type of readdisklabel() to const char *
I hope I've found all the correct places!

Memset disklabel area to zero before beginning when constructing default
labels. Problem noticed and tested by dan@.

branches: 1.3.2;
We need to pass the dk_softc, not the osc.

We need to do biodone() if strategy is called on an unconfigured device.

A slight abstraction for disks. This is mainly [right now] in
support of the cryptographic disk which I'll be checking in shortly.

Drop now unused dk_lookup function.

Bail when dkdriver hasn't been initialized. This can happen when
attachment failed or when it hasn't finished yet.

Store a reference to the CPU that submitted the I/O request with the
request itself.

wether -> whether

Add a disk ioctl DIOCRMWEDGES to remove all wedges of a given disk
(if not busy).

fix the disklabel sanity check coversion for case when both disklabel
and disk geometry are > DEV_BSIZE, such as fictitious cd(4) disklabel

still part of PR kern/53833

convert the sector counts for label sanity checks to use same unit (DEV_BSIZE),
so that the check is meaningful if disklabel sector size and disk geometry
sector size differ - for example 512 disklabel vs 2048 for sparc cd(4)

conversion assumes that the sector sizes are multiples of DEV_BSIZE (512)

fixes kern/53833 by Andreas Gustafsson

Note: the checks are executed #ifdef DIAGNOSTIC, that's why nothing
is printed by 8.0 kernel, or anything built from release branches

rnd_add_uint32() doens't support concurent calls for the same rnd_source,
call it with dksc->sc_iolock held.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.102.2;
Support dump on wedges.

branches: 1.101.2;
add KASSERT() just before setting sc_deferred, to ensure this does
not trigger problem in PR kern/52769

Use driver specific label code as fallback. This fixes the UDF label for CDs.

Initialize error also in the case where len=0, which just succeeds.
while here, assert that the len is indeed non-negative. this is already
confirmed by sys_fdiscard, but let's be sure.

reported by: GCC, but with different compile flags

validate length for discard operation and split operation when byte length
doesn't fit into 'int'.

branches: 1.97.2;
do not attach nvme ld as randomness source - device is too fast, it overwhelms
the rndq handling code, and causes system crashes; gathering rnd there is
also bad idea from performance perspective

branches: 1.96.4;
Enhance disk metrics by calculating a weighted sum that is incremented
by the number of concurrent I/O requests. Also introduce a new disk_wait()
function to measure requests waiting in a bufq.
iostat -y now reports data about waiting and active requests.

So far only drivers using dksubr and dk, ccd, wd and xbd collect data about
waiting requests.

pacify disklabel validation message

branches: 1.94.2;
Fix race condition in dksubr, where a dk_start from another thread
or interrupt was ignored while the queue was processed.

Bump kernel revision for changed dk_softc.

invoke optional d_label callback to give the driver the possibility
to adjust the label with driver specific data.

Extend dkdriver interface with a d_firstopen function. This is called
by dk_open() for the first opener and mirrors the use of the d_lastclose
callback.

Bump kernel version for the interface change.

revert 1.90 of dksubr.c and change sc_deferred back to simple pointer; the
global sc_busy flag guards against race so it's not actually necessary, and
this place is unlikely to need to be parallelized in near future

discussed with mlelstv@

change sc_deferred to TAILQ (reusing bufq b_actq) to avoid possible buf leak
for MPSAFE drivers

Set b_resid in error path.

branches: 1.88.2;
CID 1362902: forward null
CID 136290{3,4}: missing break

Avoid NULL deref in case no bufq has been set.

erase dangling pointer to prevent reuse

support deferral of diskstart to a separate thread.

more sanity checks

Replace DIOCGPART -> DIOCGPARTINFO which returns the data needed instead of
pointers.

bounds check requires consistent units, i.e. DEV_BSIZE.

remove extra quote

fix this differently.

fix build failure on i386.

fix constant name

Fix dumping code (dk_dump):
- set DKF_TAKEDUMP on attach, otherwise we can never dump
- add DKF_DUMP debugging
- use __func__ instead of hard-coding names
- only allow dumps on swap partitions

move entropy gathering into dksubr.

Prevent race condition where two threads can defer a buffer.

Make dksubr use a spin-mutex again, since some drivers still call dk_done
from hardware interrupt. Instead, release mutex while calling start routine.

The buffer peek/use/get sequence which can no longer be atomic. So consume
the buffer directly and on error privately save and retry the buffer later.
The dk_drain function is used to flush such a deferred buffer together with
the buffer queue.
Adjust drivers to use dk_drain.

Fix an error path where dk_done was called while the lock was already held.

An adaptive mutex is sufficient, the data structures are accessed
by regular threads and by the biodone softint.

This allows diskstart routines to sleep (like cgd).

only touch b_resid on error.

Two changes to the dksubr interface.

- d_diskstart callback now processes a single buffer only.
The new wrapper function dk_start processes the queue,
performs other buffer handling and also provides locking
for the the data structures.

- add d_discard callback to handle device specific function inside
the new dk_discard helper function.

Replace splbio with mutex to protect queue and disk structure.
Refactor common code in dk_strategy and dk_discard into dk_translate.

Adjust and simplify ld(4), cgd(4) and xbd(4) drivers accordingly.

ld(4) now becomes MP_SAFE.

Bump kernel version.

require write access to delete a wedge

move FWRITE checks to a common place

fix diskerr message, it needs the driver name, not the device unit name.

Trailing whitespace.

Handle non-DEV_BSIZE sectors.

remove duplicate variable initializations.

Mark disklabel only invalid on the last close. Existing openers might see
temporarily invalid data while it is re-read.

CID 1297229: use strlcpy

CID 1297229: Memory - illegal accesses (BUFFER_SIZE_WARNING)

warn about labels only when built with DIAGNOSTIC

Merge dk_intf and dkdriver interfaces.
Merge common disk driver functionality in ld.c with dksubr.c.
Adjust the two previous users of dk_intf (cgd and xbd) to
the changes.

bump kernel version to 7.99.14

correctly return -1 on error in dk_size

make more drivers use disk_ioctl, and add a dev parameter to it so that
we can merge the "easy" disklabel ioctls to it. Ultimately all this will
go do dk_ioctl once all the drivers have been converted.

Centralize wedge ioctls in disk_ioctl.

Implement DIOCGMEDIASIZE and DIOCGSECTORSIZE from FreeBSD.

align dk_strategy with checks from ld.c

branches: 1.54.2;
support DIOCMWEDGES ioctl.

No longer warn about differences bewteen disk size and total sector count
in disklabel when the latter is just clamped to the maximum.

clamp total number of sectors to UINT32_MAX instead of providing the
lower 32bit of the 64bit number.

branches: 1.51.2;
Change dk_lookup() to return an anonymous vnode not associated with
any file system. Change all consumers of dk_lookup() to get the
device from "v_rdev" instead of VOP_GETATTR() as specfs does not
support VOP_GETATTR(). Devices obtained with dk_lookup() will no
longer disappear on forced unmounts.

Fix for PR kern/48849 (root mirror raid fails on shutdown)

Welcome to 6.99.44

As proposed in
https://mail-index.netbsd.org/tech-kern/2014/05/21/msg017098.html
remove dk_start() and dk_iodone() from dksubr.c and move the related code
to the underlying driver.
This increase complexity only marginally: the underlying drivers have
to do the while() loop themselves, but this can now be done properly with
bufq_peek()/bufq_get(), removing the buffer from the queue at the right time.
This handle both the recursion and reordering issues (the reordering
issue is described here:
https://mail-index.netbsd.org/tech-kern/2014/05/19/msg017089.html
the recursion isssue is PR #25240).

Difference with the patch posted to tech-kern@: KASSERT() that the
buffer we remove with bufq_get() is the same as the one we bufq_peek()'d
just before.
Hopefully this will allow more disk drivers to use dksubr.c

branches: 1.49.2;
Make dksubr.c into a module, and make the cgd and dm modules depend on
it.

Now that cgd is completely modularized, descend into modules/cgd to
actually create the module.

branches: 1.48.2;
eliminate sc_size and fix printf formats

eliminate dk_geom

phase 1 of disk geometry cleanup:
- centralize the geometry -> plist code so that we don't have
n useless copies of it.

branches: 1.45.2;
Fix 32/64 bit int truncation issue.

Revert a few lines of accidental commit.

Modify dksubr.c to add a function that sets the disk properties in
the drvctl framework. And call this new functionality from cgd(4),
the consumer of dksubr.c. We do this to allow gpt(8) to be able
to label cgd(4) disks. We also add in some DIOCGSECTORSIZE logic
and we ensure that the WEDGE ioctls are not called on either
uninitialised disks or disks which have not been opened for write
access.