Add containment for the cloning devices hack in vn_open.

Cloning devices (and also things like /dev/stderr) work by allocating
a struct file, stuffing it in the file table (which is a layer
violation), stuffing the file descriptor number for it in a magic
field of struct lwp (which is gross), and then "failing" with one of
two magic errnos, EDUPFD or EMOVEFD.

Before this commit, all callers of vn_open in the kernel (there are
quite a few) were expected to check for these errors and handle the
situation. Needless to say, none of them except for open() itself did,
resulting in internal negative errnos being returned to userspace.

This hack is fairly deeply rooted and cannot be eliminated all at
once. This commit adds logic to handle the magic errnos inside
vn_open; now on success vn_open returns either a vnode or an integer
file descriptor, along with a flag that says whether the underlying
code requested EDUPFD or EMOVEFD. Callers not prepared to cope with
file descriptors can pass NULL for the extra return values, in which
case if a file descriptor would be produced vn_open fails with
EOPNOTSUPP.

Since I'm rearranging vn_open's signature anyway, stop exposing struct
nameidata. Instead, take three arguments: an optional vnode to use as
the starting point (like openat()), the path, and additional namei
flags to use, restricted to NOCHROOT and TRYEMULROOT. (Other namei
behavior, e.g. NOFOLLOW, can be requested via the open flags.)

This change requires a kernel bump. Ride the one an hour ago.
(That was supposed to be coordinated; did not intend to let an hour
slip by. My fault.)

remove checks for failure after memory allocation calls that cannot fail:

kmem_alloc() with KM_SLEEP
kmem_zalloc() with KM_SLEEP
percpu_alloc()
pserialize_create()
psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Split the data+bss+rodata segment in two data+bss and rodata segments. The
latter is made read-only.

branches: 1.9.2;
When loading a module from VFS and from the bootloader, the kernel packs
up the module segments into one big RWX chunk. Split this chunk into two
different text and data+bss+rodata chunks. The latter is made non-
executable. This also provides some kind of ASLR, since the chunks are
not necessarily contiguous.

to garnish, dust with _KERNEL_OPT

branches: 1.7.6;
Remove unused variable

branches: 1.6.2; 1.6.12; 1.6.16;
Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

Do not not look for modules in the current working directory first. This is
to prevent from accidentally loading ./module.kmod when we actually wanted to
load module from the system module area.

To load a module from a filesystem path, the module name must contain at
least on path separator character (/), to load a module from the system
module areas, the name must not contain a path separator character:

modload ./mymod.kmod # loads mymod.kmod from the curren directory
modload mymod # loads mymod.kmod from the system module area

Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.2.2; 1.2.4; 1.2.6;
Rename a few routines from _file() to _vfs() for consistency.
Ride 5.99.24 bump.

Due to the schizophrenic nature of kobj (mem + vfs source),
split the module in twain to subj_kobj.c (master + mem) and
subr_kobj_vfs.c (vfs).

remove checks for failure after memory allocation calls that cannot fail:

kmem_alloc() with KM_SLEEP
kmem_zalloc() with KM_SLEEP
percpu_alloc()
pserialize_create()
psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Split the data+bss+rodata segment in two data+bss and rodata segments. The
latter is made read-only.

branches: 1.9.2;
When loading a module from VFS and from the bootloader, the kernel packs
up the module segments into one big RWX chunk. Split this chunk into two
different text and data+bss+rodata chunks. The latter is made non-
executable. This also provides some kind of ASLR, since the chunks are
not necessarily contiguous.

to garnish, dust with _KERNEL_OPT

branches: 1.7.6;
Remove unused variable

branches: 1.6.2; 1.6.12; 1.6.16;
Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

Do not not look for modules in the current working directory first. This is
to prevent from accidentally loading ./module.kmod when we actually wanted to
load module from the system module area.

To load a module from a filesystem path, the module name must contain at
least on path separator character (/), to load a module from the system
module areas, the name must not contain a path separator character:

modload ./mymod.kmod # loads mymod.kmod from the curren directory
modload mymod # loads mymod.kmod from the system module area

Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.2.2; 1.2.4; 1.2.6;
Rename a few routines from _file() to _vfs() for consistency.
Ride 5.99.24 bump.

Due to the schizophrenic nature of kobj (mem + vfs source),
split the module in twain to subj_kobj.c (master + mem) and
subr_kobj_vfs.c (vfs).

Split the data+bss+rodata segment in two data+bss and rodata segments. The
latter is made read-only.

branches: 1.9.2;
When loading a module from VFS and from the bootloader, the kernel packs
up the module segments into one big RWX chunk. Split this chunk into two
different text and data+bss+rodata chunks. The latter is made non-
executable. This also provides some kind of ASLR, since the chunks are
not necessarily contiguous.

to garnish, dust with _KERNEL_OPT

branches: 1.7.6;
Remove unused variable

branches: 1.6.2; 1.6.12; 1.6.16;
Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

Do not not look for modules in the current working directory first. This is
to prevent from accidentally loading ./module.kmod when we actually wanted to
load module from the system module area.

To load a module from a filesystem path, the module name must contain at
least on path separator character (/), to load a module from the system
module areas, the name must not contain a path separator character:

modload ./mymod.kmod # loads mymod.kmod from the curren directory
modload mymod # loads mymod.kmod from the system module area

Introduce struct pathbuf. This is an abstraction to hold a pathname
and the metadata required to interpret it. Callers of namei must now
create a pathbuf and pass it to NDINIT (instead of a string and a
uio_seg), then destroy the pathbuf after the namei session is
complete.

Update all namei call sites accordingly. Add a pathbuf(9) man page and
update namei(9).

The pathbuf interface also now appears in a couple of related
additional places that were passing string/uio_seg pairs that were
later fed into NDINIT. Update other call sites accordingly.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.2.2; 1.2.4; 1.2.6;
Rename a few routines from _file() to _vfs() for consistency.
Ride 5.99.24 bump.

Due to the schizophrenic nature of kobj (mem + vfs source),
split the module in twain to subj_kobj.c (master + mem) and
subr_kobj_vfs.c (vfs).