Add a helper to set or clear lower mount and use it.
Always add a reference to the lower mount.

Ride 9.99.105

miscfs/deadfs/deadfs.h: New home for deadfs-related externs.

XXX regen sys/kern/vnode_if.c and the others

Don't allocate lwp info for fstrans_held() and fstrans_is_owner().
If it doesn't exist we cannot hold a transaction or suspension.

Finish previous, evaluate the lowest mount on first access
to "struct mount_info" and store it here so we no longer
derefence the "struct mount" from fstrans_alloc_lwp_info().

Reported-by: syzbot+5a79214d043395b550d8@syzkaller.appspotmail.com

While one thread runs vgone() it is possible for another thread to grab
a "v_mount" that will be freed before it uses this mount for fstrans_start().

Add a hashtab to lookup our private mount data "fstrans_mount_info" and
use "mp" as an opaque key for lookup.

Reported-by: syzbot+54dc9ac0804a97b59bc6@syzkaller.appspotmail.com

Handle IMNT_GONE on the file system we want suspended not its
lowest mount we really suspend.

fstrans(9): KASSERT(a && b) => KASSERT(a); KASSERT(b)

No functional change intended except better diagnostics in case of
crash.

Reorganise the locking and allocation of fstrans_lwp_info slightly, to
reduce contention. "please go ahead" hannken@.

Add operation fstrans_held(struct mount *), true if the current thread
holds a fstrans lock.

Ride 9.99.61

Add an owner field to fstrans mount info and use it to hold
the thread currently suspending this mount.

Remove now unneeded state FSTRANS_EXCL.

It is now possible to suspend a file system from a thread
already holding fstrans locks. Use with care ...

Walk down to the lowest mount for "fli_alias".

Address PR kern/54195 (null mounts: panic: ...).

Add reference counting to alias states to prevent them disappearing
while still in use.

Change "fli_alias" to point to the corresponding "fstrans_lwp_info".

Fix fstrans_clear_lwp_info() list traversal, remove already advanced
the list pointer.

Move pointer to fstrans private data into "struct lwp".

Ride NetBSD 8.99.35

Clear per-lwp entries whose mount is gone before the first return
from fstrans_done().

No longer leaks "struct mount" forever.

Fix bad assertion: vfs_suspend(dead_rootmount) may happen and
must return EOPNOTSUPP.

- Make the fstrans mount info part of the per-lwp state and replace
most accesses to the mount with fstrans mount info.

- Add "fmi_gone" to be true after unmount and add a counter of
outstanding mount infos so fstrans_clear_lwp_info() only runs
if there may be something to do.

- Move lookup of base mounts into per-lwp state.

- Keep a list of valid mounts for DIAGNOSTIC checks.

Move fstrans_unmount() to vfs_rele(), just before it would free the mount.
Don't take a mount reference for fstrans as it gets notified about the release.

Defer the final free of the mount to fstrans_mount_dtor() when fstrans
has released all references to this mount. Prevents the mount's memory
to be reused as a new mount before fstrans released all references.

Address PR kern/53928 modules/t_builtin:disable test case randomly fails.

Attach "mnt_transinfo" to "dead_rootmount" so every mount has a
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.

Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.

Bring back three state file system suspension:

NORMAL -> SUSPENDING -> SUSPENDED

and add operation fstrans_start_lazy() that only blocks while SUSPENDED.

Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().

PR kern/53624 (dom0 freeze on domU exit)

Back out sftchg/fstcnt deadlock workaround

The change did prevent some system freeze, but caused spurious
unmount failures reporter by bouyer@.

hannken@ is working on the right fix, see kern/53624

Work around deadlock between fstchg and fstcnt

When suspending a filesystem in fstrans_setstate(), we wait on
fstcnt for threads to finish transactions. While we do this, any
thread trying to start a filesystem transaction will wait on fstchg
in fstrans_start(), a situation which can deadlock.

The wait for fstcnt in fstrans_setstate() can be interrupted by
a signal, but the wait for fstchg in fstrans_start() cannot. Once
most processes are stuck in fstchg, it is impossible to send a
signal to the thread that waits on fstcnt, because no process
respond anymore to user input.

We fix that by adding a timeout to the wait on fstcnt in
fstrans_setstate(). This means suspending a filesystem may fail,
but it was already the case when the sleep was interupted by
a signal, hence calling function must already handle a possible
failure.

Fixes kern/53624

branches: 1.48.4; 1.48.6;
Make the fast path of fstrans_get_lwp_info() "static inline".

Clear fstrans entries whose mount is gone from the last fstrans_done() only.

Operations fstrans_start() and fstrans_start_nowait() now always
use FSTRANS_SHARED as lock type so remove the lock type argument.

File system state FSTRANS_SUSPENDING is now unused so remove it.

Regen vnode_if files.

Ride 8.99.1 less than a hour ago.

branches: 1.45.2;
Move fstrans initialization to vfs_mountalloc().

Handle the case where the mount is gone and its mnt_transinfo is NULL.

branches: 1.43.2;
Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch fstrans_dump() to _mountlist_next().

Change _fstrans_start() to allocate per lwp info for layered file
systems to get a reference on the mount.

Set mnt_lower on successfull mount only.

Always use the lowest mount for fstrans and suspend. This way we
enter/leave or suspend/resume the stack of layered file systems as a unit.

Add an operation to test a mount for fstrans support and use it for
_fstrans_start(), fstrans_done(), fstrans_is_owner(), vfs_suspend()
and vfs_resume().

Test for fstrans support before ASSERT_SLEEPABLE().

Test for fstrans support before trying to allocate per-thread info.

PR kern/51996 (kmem_alloc called from intr context in fstrans_get_lwp_info)

Let syncer try fstrans_start() before running VFS_SYNC() to get rid
of the syncer lock/unlock from vfs_suspend().

Protect attaching and detaching lwp_info to mount with a mutex.

branches: 1.34.2; 1.34.4;
to garnish, dust with _KERNEL_OPT

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Don't check if constant-sized KM_SLEEP allocations succeeded.

branches: 1.31.2;
Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Fix a deadlock where one thread exits, enters fstrans_lwp_dtor()
and wants fstrans_lock. This thread holds the proc_lock.
Another thread holds fstrans_lock and runs pserialize_perform().
As the first thread holds the proc_lock, timeouts are blocked and
the second thread blocks forever in kpause().

Change fstrans_lwp_dtor() to invalidate, but not free its info
structs. No need to take fstrans_lock.

Change fstrans_get_lwp_info() to reuse invalidated info before
trying to allocate a new one.

branches: 1.29.2;
change the mountlist CIRCLEQ into a TAILQ

Mark diagnostic-only variables

Replace macro v_specmountpoint with two functions spec_node_getmountedfs()
and spec_node_setmountedfs() to manage the file system mounted on a device.
Assert the device is a block device.

Welcome to 6.99.24

Discussed on tech-kern@ some time ago.

Reviewed by: David Holland <dholland@netbsd.org>

branches: 1.26.2;
Replace the rwlock based implementation with passive serialization
from pserialize(9) and mutex / condvar.

The fast paths (fstrans_start/fstrans_done on a file system not
suspended or suspending and fscow_run with no change pending) now
run without locks or other atomic operations. Suspension and cow
handler insertion and removal is done with mutex / condvars.

The API remains unchanged.

branches: 1.25.12; 1.25.22;
don't forget to skip marker processes.

branches: 1.24.4;
more <sys/buf.h> police

branches: 1.23.2; 1.23.4; 1.23.6;
Replace the fss unmount hook with a vfs_hook.

fssvar.h: struct device * -> device_t.
fss.c: establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c: destroy cow handlers on unmount as fstrans_unmount() will be
called before vfs_hooks.

branches: 1.22.2;
Use pool_cache.

branches: 1.21.2;
Remove a bad assertion from last commit.
Non bufcache buffers may have BC_BUSY unset.

Fscow_run() may recurse into itself.
Take care by adding a per-lwp recursion counter.

branches: 1.19.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.18.2; 1.18.4;
- simplify ASSERT_SLEEPABLE.
- move it from proc.h to systm.h.
- add some more checks.
- make it a little more lkm friendly.

branches: 1.17.2; 1.17.6;
BO_COWDONE -> B_COWDONE: this flag is tested/modified from the thread owning
the buffer and therefore needs no protection by a mutex.

Ok: Andrew Doran <ad@netbsd.org>

Merge vmlocking2 to head.

branches: 1.15.2; 1.15.6;
Fscow_run(): add a flag "bool data_valid" to note still valid data.
Buffers run through copy-on-write are marked B_COWDONE. This condition
is valid until the buffer has run through bwrite() and gets cleared from
biodone().

Welcome to 4.99.39.

Reviewed by: YAMAMOTO Takashi <yamt@netbsd.org>

branches: 1.14.4;
fscow_run(): Check for NULL mount and don't run the cow handler in this case.

Remove an include committed by accident.

From Chris Ross via current-users.

Update the file system copy-on-write handler.

- Instead of hooking the handler on the specdev of a mounted file system
hook directly on the `struct mount'.

- Rename from `vn_cow_*' to `fscow_*' and move to `kern/vfs_trans.c'. Use
`mount_*specific' instead of clobbering `struct mount' or `struct specinfo'.

- Replace the hand-made reader/writer lock with a krwlock.

- Keep `vn_cow_*' functions and mark as obsolete.

- Welcome to NetBSD 4.99.32 - `struct specinfo' changed size.

Reviewed by: Jason Thorpe <thorpej@netbsd.org>

branches: 1.11.4; 1.11.6; 1.11.8; 1.11.10;
Use eopnotsupp() instead of vfs_stdsuspendctl() and retire the latter.

branches: 1.10.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Fstrans_start() always returns zero, so change its type to void.

Use rwlock for fmi_shared_lock and fmi_lazy_lock.

Ok: Andrew Doran <ad@netbsd.org>

Use mutexes/condvars.

branches: 1.6.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.5.2; 1.5.4; 1.5.8;
Make fstrans(9) the default helper for file system suspension.
Replaces the now obsolete vn_start_write()/vn_finished_write().

Replace some uses of lockmgr() / simplelocks.

newlock2: syncer_lock is now a mutex.

branches: 1.2.2;
Change fstrans enum types to upper case.
No functional change.

From Antti Kantee <pooka@netbsd.org>

New file system suspension API to replace vn_start_write and vn_finished_write.
The suspension helpers are now put into file system specific operations.
This means every file system not supporting these helpers cannot be suspended
and therefore snapshots are no longer possible.

Implemented for file systems of type ffs.

The new API is enabled on a kernel option NEWVNGATE. This option is
not enabled by default in any kernel config.

Presented and discussed on tech-kern with much input from
Bill Studenmund <wrstuden@netbsd.org> and YAMAMOTO Takashi <yamt@netbsd.org>.

Welcome to 4.99.9 (new vfs op vfs_suspendctl).

miscfs/deadfs/deadfs.h: New home for deadfs-related externs.

XXX regen sys/kern/vnode_if.c and the others

Don't allocate lwp info for fstrans_held() and fstrans_is_owner().
If it doesn't exist we cannot hold a transaction or suspension.

Finish previous, evaluate the lowest mount on first access
to "struct mount_info" and store it here so we no longer
derefence the "struct mount" from fstrans_alloc_lwp_info().

Reported-by: syzbot+5a79214d043395b550d8@syzkaller.appspotmail.com

While one thread runs vgone() it is possible for another thread to grab
a "v_mount" that will be freed before it uses this mount for fstrans_start().

Add a hashtab to lookup our private mount data "fstrans_mount_info" and
use "mp" as an opaque key for lookup.

Reported-by: syzbot+54dc9ac0804a97b59bc6@syzkaller.appspotmail.com

Handle IMNT_GONE on the file system we want suspended not its
lowest mount we really suspend.

fstrans(9): KASSERT(a && b) => KASSERT(a); KASSERT(b)

No functional change intended except better diagnostics in case of
crash.

Reorganise the locking and allocation of fstrans_lwp_info slightly, to
reduce contention. "please go ahead" hannken@.

Add operation fstrans_held(struct mount *), true if the current thread
holds a fstrans lock.

Ride 9.99.61

Add an owner field to fstrans mount info and use it to hold
the thread currently suspending this mount.

Remove now unneeded state FSTRANS_EXCL.

It is now possible to suspend a file system from a thread
already holding fstrans locks. Use with care ...

Walk down to the lowest mount for "fli_alias".

Address PR kern/54195 (null mounts: panic: ...).

Add reference counting to alias states to prevent them disappearing
while still in use.

Change "fli_alias" to point to the corresponding "fstrans_lwp_info".

Fix fstrans_clear_lwp_info() list traversal, remove already advanced
the list pointer.

Move pointer to fstrans private data into "struct lwp".

Ride NetBSD 8.99.35

Clear per-lwp entries whose mount is gone before the first return
from fstrans_done().

No longer leaks "struct mount" forever.

Fix bad assertion: vfs_suspend(dead_rootmount) may happen and
must return EOPNOTSUPP.

- Make the fstrans mount info part of the per-lwp state and replace
most accesses to the mount with fstrans mount info.

- Add "fmi_gone" to be true after unmount and add a counter of
outstanding mount infos so fstrans_clear_lwp_info() only runs
if there may be something to do.

- Move lookup of base mounts into per-lwp state.

- Keep a list of valid mounts for DIAGNOSTIC checks.

Move fstrans_unmount() to vfs_rele(), just before it would free the mount.
Don't take a mount reference for fstrans as it gets notified about the release.

Defer the final free of the mount to fstrans_mount_dtor() when fstrans
has released all references to this mount. Prevents the mount's memory
to be reused as a new mount before fstrans released all references.

Address PR kern/53928 modules/t_builtin:disable test case randomly fails.

Attach "mnt_transinfo" to "dead_rootmount" so every mount has a
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.

Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.

Bring back three state file system suspension:

NORMAL -> SUSPENDING -> SUSPENDED

and add operation fstrans_start_lazy() that only blocks while SUSPENDED.

Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().

PR kern/53624 (dom0 freeze on domU exit)

Back out sftchg/fstcnt deadlock workaround

The change did prevent some system freeze, but caused spurious
unmount failures reporter by bouyer@.

hannken@ is working on the right fix, see kern/53624

Work around deadlock between fstchg and fstcnt

When suspending a filesystem in fstrans_setstate(), we wait on
fstcnt for threads to finish transactions. While we do this, any
thread trying to start a filesystem transaction will wait on fstchg
in fstrans_start(), a situation which can deadlock.

The wait for fstcnt in fstrans_setstate() can be interrupted by
a signal, but the wait for fstchg in fstrans_start() cannot. Once
most processes are stuck in fstchg, it is impossible to send a
signal to the thread that waits on fstcnt, because no process
respond anymore to user input.

We fix that by adding a timeout to the wait on fstcnt in
fstrans_setstate(). This means suspending a filesystem may fail,
but it was already the case when the sleep was interupted by
a signal, hence calling function must already handle a possible
failure.

Fixes kern/53624

branches: 1.48.4; 1.48.6;
Make the fast path of fstrans_get_lwp_info() "static inline".

Clear fstrans entries whose mount is gone from the last fstrans_done() only.

Operations fstrans_start() and fstrans_start_nowait() now always
use FSTRANS_SHARED as lock type so remove the lock type argument.

File system state FSTRANS_SUSPENDING is now unused so remove it.

Regen vnode_if files.

Ride 8.99.1 less than a hour ago.

branches: 1.45.2;
Move fstrans initialization to vfs_mountalloc().

Handle the case where the mount is gone and its mnt_transinfo is NULL.

branches: 1.43.2;
Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch fstrans_dump() to _mountlist_next().

Change _fstrans_start() to allocate per lwp info for layered file
systems to get a reference on the mount.

Set mnt_lower on successfull mount only.

Always use the lowest mount for fstrans and suspend. This way we
enter/leave or suspend/resume the stack of layered file systems as a unit.

Add an operation to test a mount for fstrans support and use it for
_fstrans_start(), fstrans_done(), fstrans_is_owner(), vfs_suspend()
and vfs_resume().

Test for fstrans support before ASSERT_SLEEPABLE().

Test for fstrans support before trying to allocate per-thread info.

PR kern/51996 (kmem_alloc called from intr context in fstrans_get_lwp_info)

Let syncer try fstrans_start() before running VFS_SYNC() to get rid
of the syncer lock/unlock from vfs_suspend().

Protect attaching and detaching lwp_info to mount with a mutex.

branches: 1.34.2; 1.34.4;
to garnish, dust with _KERNEL_OPT

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Don't check if constant-sized KM_SLEEP allocations succeeded.

branches: 1.31.2;
Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Fix a deadlock where one thread exits, enters fstrans_lwp_dtor()
and wants fstrans_lock. This thread holds the proc_lock.
Another thread holds fstrans_lock and runs pserialize_perform().
As the first thread holds the proc_lock, timeouts are blocked and
the second thread blocks forever in kpause().

Change fstrans_lwp_dtor() to invalidate, but not free its info
structs. No need to take fstrans_lock.

Change fstrans_get_lwp_info() to reuse invalidated info before
trying to allocate a new one.

branches: 1.29.2;
change the mountlist CIRCLEQ into a TAILQ

Mark diagnostic-only variables

Replace macro v_specmountpoint with two functions spec_node_getmountedfs()
and spec_node_setmountedfs() to manage the file system mounted on a device.
Assert the device is a block device.

Welcome to 6.99.24

Discussed on tech-kern@ some time ago.

Reviewed by: David Holland <dholland@netbsd.org>

branches: 1.26.2;
Replace the rwlock based implementation with passive serialization
from pserialize(9) and mutex / condvar.

The fast paths (fstrans_start/fstrans_done on a file system not
suspended or suspending and fscow_run with no change pending) now
run without locks or other atomic operations. Suspension and cow
handler insertion and removal is done with mutex / condvars.

The API remains unchanged.

branches: 1.25.12; 1.25.22;
don't forget to skip marker processes.

branches: 1.24.4;
more <sys/buf.h> police

branches: 1.23.2; 1.23.4; 1.23.6;
Replace the fss unmount hook with a vfs_hook.

fssvar.h: struct device * -> device_t.
fss.c: establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c: destroy cow handlers on unmount as fstrans_unmount() will be
called before vfs_hooks.

branches: 1.22.2;
Use pool_cache.

branches: 1.21.2;
Remove a bad assertion from last commit.
Non bufcache buffers may have BC_BUSY unset.

Fscow_run() may recurse into itself.
Take care by adding a per-lwp recursion counter.

branches: 1.19.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.18.2; 1.18.4;
- simplify ASSERT_SLEEPABLE.
- move it from proc.h to systm.h.
- add some more checks.
- make it a little more lkm friendly.

branches: 1.17.2; 1.17.6;
BO_COWDONE -> B_COWDONE: this flag is tested/modified from the thread owning
the buffer and therefore needs no protection by a mutex.

Ok: Andrew Doran <ad@netbsd.org>

Merge vmlocking2 to head.

branches: 1.15.2; 1.15.6;
Fscow_run(): add a flag "bool data_valid" to note still valid data.
Buffers run through copy-on-write are marked B_COWDONE. This condition
is valid until the buffer has run through bwrite() and gets cleared from
biodone().

Welcome to 4.99.39.

Reviewed by: YAMAMOTO Takashi <yamt@netbsd.org>

branches: 1.14.4;
fscow_run(): Check for NULL mount and don't run the cow handler in this case.

Remove an include committed by accident.

From Chris Ross via current-users.

Update the file system copy-on-write handler.

- Instead of hooking the handler on the specdev of a mounted file system
hook directly on the `struct mount'.

- Rename from `vn_cow_*' to `fscow_*' and move to `kern/vfs_trans.c'. Use
`mount_*specific' instead of clobbering `struct mount' or `struct specinfo'.

- Replace the hand-made reader/writer lock with a krwlock.

- Keep `vn_cow_*' functions and mark as obsolete.

- Welcome to NetBSD 4.99.32 - `struct specinfo' changed size.

Reviewed by: Jason Thorpe <thorpej@netbsd.org>

branches: 1.11.4; 1.11.6; 1.11.8; 1.11.10;
Use eopnotsupp() instead of vfs_stdsuspendctl() and retire the latter.

branches: 1.10.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Fstrans_start() always returns zero, so change its type to void.

Use rwlock for fmi_shared_lock and fmi_lazy_lock.

Ok: Andrew Doran <ad@netbsd.org>

Use mutexes/condvars.

branches: 1.6.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.5.2; 1.5.4; 1.5.8;
Make fstrans(9) the default helper for file system suspension.
Replaces the now obsolete vn_start_write()/vn_finished_write().

Replace some uses of lockmgr() / simplelocks.

newlock2: syncer_lock is now a mutex.

branches: 1.2.2;
Change fstrans enum types to upper case.
No functional change.

From Antti Kantee <pooka@netbsd.org>

New file system suspension API to replace vn_start_write and vn_finished_write.
The suspension helpers are now put into file system specific operations.
This means every file system not supporting these helpers cannot be suspended
and therefore snapshots are no longer possible.

Implemented for file systems of type ffs.

The new API is enabled on a kernel option NEWVNGATE. This option is
not enabled by default in any kernel config.

Presented and discussed on tech-kern with much input from
Bill Studenmund <wrstuden@netbsd.org> and YAMAMOTO Takashi <yamt@netbsd.org>.

Welcome to 4.99.9 (new vfs op vfs_suspendctl).

Don't allocate lwp info for fstrans_held() and fstrans_is_owner().
If it doesn't exist we cannot hold a transaction or suspension.

Finish previous, evaluate the lowest mount on first access
to "struct mount_info" and store it here so we no longer
derefence the "struct mount" from fstrans_alloc_lwp_info().

Reported-by: syzbot+5a79214d043395b550d8@syzkaller.appspotmail.com

While one thread runs vgone() it is possible for another thread to grab
a "v_mount" that will be freed before it uses this mount for fstrans_start().

Add a hashtab to lookup our private mount data "fstrans_mount_info" and
use "mp" as an opaque key for lookup.

Reported-by: syzbot+54dc9ac0804a97b59bc6@syzkaller.appspotmail.com

Handle IMNT_GONE on the file system we want suspended not its
lowest mount we really suspend.

fstrans(9): KASSERT(a && b) => KASSERT(a); KASSERT(b)

No functional change intended except better diagnostics in case of
crash.

Reorganise the locking and allocation of fstrans_lwp_info slightly, to
reduce contention. "please go ahead" hannken@.

Add operation fstrans_held(struct mount *), true if the current thread
holds a fstrans lock.

Ride 9.99.61

Add an owner field to fstrans mount info and use it to hold
the thread currently suspending this mount.

Remove now unneeded state FSTRANS_EXCL.

It is now possible to suspend a file system from a thread
already holding fstrans locks. Use with care ...

Walk down to the lowest mount for "fli_alias".

Address PR kern/54195 (null mounts: panic: ...).

Add reference counting to alias states to prevent them disappearing
while still in use.

Change "fli_alias" to point to the corresponding "fstrans_lwp_info".

Fix fstrans_clear_lwp_info() list traversal, remove already advanced
the list pointer.

Move pointer to fstrans private data into "struct lwp".

Ride NetBSD 8.99.35

Clear per-lwp entries whose mount is gone before the first return
from fstrans_done().

No longer leaks "struct mount" forever.

Fix bad assertion: vfs_suspend(dead_rootmount) may happen and
must return EOPNOTSUPP.

- Make the fstrans mount info part of the per-lwp state and replace
most accesses to the mount with fstrans mount info.

- Add "fmi_gone" to be true after unmount and add a counter of
outstanding mount infos so fstrans_clear_lwp_info() only runs
if there may be something to do.

- Move lookup of base mounts into per-lwp state.

- Keep a list of valid mounts for DIAGNOSTIC checks.

Move fstrans_unmount() to vfs_rele(), just before it would free the mount.
Don't take a mount reference for fstrans as it gets notified about the release.

Defer the final free of the mount to fstrans_mount_dtor() when fstrans
has released all references to this mount. Prevents the mount's memory
to be reused as a new mount before fstrans released all references.

Address PR kern/53928 modules/t_builtin:disable test case randomly fails.

Attach "mnt_transinfo" to "dead_rootmount" so every mount has a
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.

Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.

Bring back three state file system suspension:

NORMAL -> SUSPENDING -> SUSPENDED

and add operation fstrans_start_lazy() that only blocks while SUSPENDED.

Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().

PR kern/53624 (dom0 freeze on domU exit)

Back out sftchg/fstcnt deadlock workaround

The change did prevent some system freeze, but caused spurious
unmount failures reporter by bouyer@.

hannken@ is working on the right fix, see kern/53624

Work around deadlock between fstchg and fstcnt

When suspending a filesystem in fstrans_setstate(), we wait on
fstcnt for threads to finish transactions. While we do this, any
thread trying to start a filesystem transaction will wait on fstchg
in fstrans_start(), a situation which can deadlock.

The wait for fstcnt in fstrans_setstate() can be interrupted by
a signal, but the wait for fstchg in fstrans_start() cannot. Once
most processes are stuck in fstchg, it is impossible to send a
signal to the thread that waits on fstcnt, because no process
respond anymore to user input.

We fix that by adding a timeout to the wait on fstcnt in
fstrans_setstate(). This means suspending a filesystem may fail,
but it was already the case when the sleep was interupted by
a signal, hence calling function must already handle a possible
failure.

Fixes kern/53624

branches: 1.48.4; 1.48.6;
Make the fast path of fstrans_get_lwp_info() "static inline".

Clear fstrans entries whose mount is gone from the last fstrans_done() only.

Operations fstrans_start() and fstrans_start_nowait() now always
use FSTRANS_SHARED as lock type so remove the lock type argument.

File system state FSTRANS_SUSPENDING is now unused so remove it.

Regen vnode_if files.

Ride 8.99.1 less than a hour ago.

branches: 1.45.2;
Move fstrans initialization to vfs_mountalloc().

Handle the case where the mount is gone and its mnt_transinfo is NULL.

branches: 1.43.2;
Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch fstrans_dump() to _mountlist_next().

Change _fstrans_start() to allocate per lwp info for layered file
systems to get a reference on the mount.

Set mnt_lower on successfull mount only.

Always use the lowest mount for fstrans and suspend. This way we
enter/leave or suspend/resume the stack of layered file systems as a unit.

Add an operation to test a mount for fstrans support and use it for
_fstrans_start(), fstrans_done(), fstrans_is_owner(), vfs_suspend()
and vfs_resume().

Test for fstrans support before ASSERT_SLEEPABLE().

Test for fstrans support before trying to allocate per-thread info.

PR kern/51996 (kmem_alloc called from intr context in fstrans_get_lwp_info)

Let syncer try fstrans_start() before running VFS_SYNC() to get rid
of the syncer lock/unlock from vfs_suspend().

Protect attaching and detaching lwp_info to mount with a mutex.

branches: 1.34.2; 1.34.4;
to garnish, dust with _KERNEL_OPT

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Don't check if constant-sized KM_SLEEP allocations succeeded.

branches: 1.31.2;
Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Fix a deadlock where one thread exits, enters fstrans_lwp_dtor()
and wants fstrans_lock. This thread holds the proc_lock.
Another thread holds fstrans_lock and runs pserialize_perform().
As the first thread holds the proc_lock, timeouts are blocked and
the second thread blocks forever in kpause().

Change fstrans_lwp_dtor() to invalidate, but not free its info
structs. No need to take fstrans_lock.

Change fstrans_get_lwp_info() to reuse invalidated info before
trying to allocate a new one.

branches: 1.29.2;
change the mountlist CIRCLEQ into a TAILQ

Mark diagnostic-only variables

Replace macro v_specmountpoint with two functions spec_node_getmountedfs()
and spec_node_setmountedfs() to manage the file system mounted on a device.
Assert the device is a block device.

Welcome to 6.99.24

Discussed on tech-kern@ some time ago.

Reviewed by: David Holland <dholland@netbsd.org>

branches: 1.26.2;
Replace the rwlock based implementation with passive serialization
from pserialize(9) and mutex / condvar.

The fast paths (fstrans_start/fstrans_done on a file system not
suspended or suspending and fscow_run with no change pending) now
run without locks or other atomic operations. Suspension and cow
handler insertion and removal is done with mutex / condvars.

The API remains unchanged.

branches: 1.25.12; 1.25.22;
don't forget to skip marker processes.

branches: 1.24.4;
more <sys/buf.h> police

branches: 1.23.2; 1.23.4; 1.23.6;
Replace the fss unmount hook with a vfs_hook.

fssvar.h: struct device * -> device_t.
fss.c: establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c: destroy cow handlers on unmount as fstrans_unmount() will be
called before vfs_hooks.

branches: 1.22.2;
Use pool_cache.

branches: 1.21.2;
Remove a bad assertion from last commit.
Non bufcache buffers may have BC_BUSY unset.

Fscow_run() may recurse into itself.
Take care by adding a per-lwp recursion counter.

branches: 1.19.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.18.2; 1.18.4;
- simplify ASSERT_SLEEPABLE.
- move it from proc.h to systm.h.
- add some more checks.
- make it a little more lkm friendly.

branches: 1.17.2; 1.17.6;
BO_COWDONE -> B_COWDONE: this flag is tested/modified from the thread owning
the buffer and therefore needs no protection by a mutex.

Ok: Andrew Doran <ad@netbsd.org>

Merge vmlocking2 to head.

branches: 1.15.2; 1.15.6;
Fscow_run(): add a flag "bool data_valid" to note still valid data.
Buffers run through copy-on-write are marked B_COWDONE. This condition
is valid until the buffer has run through bwrite() and gets cleared from
biodone().

Welcome to 4.99.39.

Reviewed by: YAMAMOTO Takashi <yamt@netbsd.org>

branches: 1.14.4;
fscow_run(): Check for NULL mount and don't run the cow handler in this case.

Remove an include committed by accident.

From Chris Ross via current-users.

Update the file system copy-on-write handler.

- Instead of hooking the handler on the specdev of a mounted file system
hook directly on the `struct mount'.

- Rename from `vn_cow_*' to `fscow_*' and move to `kern/vfs_trans.c'. Use
`mount_*specific' instead of clobbering `struct mount' or `struct specinfo'.

- Replace the hand-made reader/writer lock with a krwlock.

- Keep `vn_cow_*' functions and mark as obsolete.

- Welcome to NetBSD 4.99.32 - `struct specinfo' changed size.

Reviewed by: Jason Thorpe <thorpej@netbsd.org>

branches: 1.11.4; 1.11.6; 1.11.8; 1.11.10;
Use eopnotsupp() instead of vfs_stdsuspendctl() and retire the latter.

branches: 1.10.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Fstrans_start() always returns zero, so change its type to void.

Use rwlock for fmi_shared_lock and fmi_lazy_lock.

Ok: Andrew Doran <ad@netbsd.org>

Use mutexes/condvars.

branches: 1.6.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.5.2; 1.5.4; 1.5.8;
Make fstrans(9) the default helper for file system suspension.
Replaces the now obsolete vn_start_write()/vn_finished_write().

Replace some uses of lockmgr() / simplelocks.

newlock2: syncer_lock is now a mutex.

branches: 1.2.2;
Change fstrans enum types to upper case.
No functional change.

From Antti Kantee <pooka@netbsd.org>

New file system suspension API to replace vn_start_write and vn_finished_write.
The suspension helpers are now put into file system specific operations.
This means every file system not supporting these helpers cannot be suspended
and therefore snapshots are no longer possible.

Implemented for file systems of type ffs.

The new API is enabled on a kernel option NEWVNGATE. This option is
not enabled by default in any kernel config.

Presented and discussed on tech-kern with much input from
Bill Studenmund <wrstuden@netbsd.org> and YAMAMOTO Takashi <yamt@netbsd.org>.

Welcome to 4.99.9 (new vfs op vfs_suspendctl).

Finish previous, evaluate the lowest mount on first access
to "struct mount_info" and store it here so we no longer
derefence the "struct mount" from fstrans_alloc_lwp_info().

Reported-by: syzbot+5a79214d043395b550d8@syzkaller.appspotmail.com

While one thread runs vgone() it is possible for another thread to grab
a "v_mount" that will be freed before it uses this mount for fstrans_start().

Add a hashtab to lookup our private mount data "fstrans_mount_info" and
use "mp" as an opaque key for lookup.

Reported-by: syzbot+54dc9ac0804a97b59bc6@syzkaller.appspotmail.com

Handle IMNT_GONE on the file system we want suspended not its
lowest mount we really suspend.

fstrans(9): KASSERT(a && b) => KASSERT(a); KASSERT(b)

No functional change intended except better diagnostics in case of
crash.

Reorganise the locking and allocation of fstrans_lwp_info slightly, to
reduce contention. "please go ahead" hannken@.

Add operation fstrans_held(struct mount *), true if the current thread
holds a fstrans lock.

Ride 9.99.61

Add an owner field to fstrans mount info and use it to hold
the thread currently suspending this mount.

Remove now unneeded state FSTRANS_EXCL.

It is now possible to suspend a file system from a thread
already holding fstrans locks. Use with care ...

Walk down to the lowest mount for "fli_alias".

Address PR kern/54195 (null mounts: panic: ...).

Add reference counting to alias states to prevent them disappearing
while still in use.

Change "fli_alias" to point to the corresponding "fstrans_lwp_info".

Fix fstrans_clear_lwp_info() list traversal, remove already advanced
the list pointer.

Move pointer to fstrans private data into "struct lwp".

Ride NetBSD 8.99.35

Clear per-lwp entries whose mount is gone before the first return
from fstrans_done().

No longer leaks "struct mount" forever.

Fix bad assertion: vfs_suspend(dead_rootmount) may happen and
must return EOPNOTSUPP.

- Make the fstrans mount info part of the per-lwp state and replace
most accesses to the mount with fstrans mount info.

- Add "fmi_gone" to be true after unmount and add a counter of
outstanding mount infos so fstrans_clear_lwp_info() only runs
if there may be something to do.

- Move lookup of base mounts into per-lwp state.

- Keep a list of valid mounts for DIAGNOSTIC checks.

Move fstrans_unmount() to vfs_rele(), just before it would free the mount.
Don't take a mount reference for fstrans as it gets notified about the release.

Defer the final free of the mount to fstrans_mount_dtor() when fstrans
has released all references to this mount. Prevents the mount's memory
to be reused as a new mount before fstrans released all references.

Address PR kern/53928 modules/t_builtin:disable test case randomly fails.

Attach "mnt_transinfo" to "dead_rootmount" so every mount has a
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.

Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.

Bring back three state file system suspension:

NORMAL -> SUSPENDING -> SUSPENDED

and add operation fstrans_start_lazy() that only blocks while SUSPENDED.

Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().

PR kern/53624 (dom0 freeze on domU exit)

Back out sftchg/fstcnt deadlock workaround

The change did prevent some system freeze, but caused spurious
unmount failures reporter by bouyer@.

hannken@ is working on the right fix, see kern/53624

Work around deadlock between fstchg and fstcnt

When suspending a filesystem in fstrans_setstate(), we wait on
fstcnt for threads to finish transactions. While we do this, any
thread trying to start a filesystem transaction will wait on fstchg
in fstrans_start(), a situation which can deadlock.

The wait for fstcnt in fstrans_setstate() can be interrupted by
a signal, but the wait for fstchg in fstrans_start() cannot. Once
most processes are stuck in fstchg, it is impossible to send a
signal to the thread that waits on fstcnt, because no process
respond anymore to user input.

We fix that by adding a timeout to the wait on fstcnt in
fstrans_setstate(). This means suspending a filesystem may fail,
but it was already the case when the sleep was interupted by
a signal, hence calling function must already handle a possible
failure.

Fixes kern/53624

branches: 1.48.4; 1.48.6;
Make the fast path of fstrans_get_lwp_info() "static inline".

Clear fstrans entries whose mount is gone from the last fstrans_done() only.

Operations fstrans_start() and fstrans_start_nowait() now always
use FSTRANS_SHARED as lock type so remove the lock type argument.

File system state FSTRANS_SUSPENDING is now unused so remove it.

Regen vnode_if files.

Ride 8.99.1 less than a hour ago.

branches: 1.45.2;
Move fstrans initialization to vfs_mountalloc().

Handle the case where the mount is gone and its mnt_transinfo is NULL.

branches: 1.43.2;
Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch fstrans_dump() to _mountlist_next().

Change _fstrans_start() to allocate per lwp info for layered file
systems to get a reference on the mount.

Set mnt_lower on successfull mount only.

Always use the lowest mount for fstrans and suspend. This way we
enter/leave or suspend/resume the stack of layered file systems as a unit.

Add an operation to test a mount for fstrans support and use it for
_fstrans_start(), fstrans_done(), fstrans_is_owner(), vfs_suspend()
and vfs_resume().

Test for fstrans support before ASSERT_SLEEPABLE().

Test for fstrans support before trying to allocate per-thread info.

PR kern/51996 (kmem_alloc called from intr context in fstrans_get_lwp_info)

Let syncer try fstrans_start() before running VFS_SYNC() to get rid
of the syncer lock/unlock from vfs_suspend().

Protect attaching and detaching lwp_info to mount with a mutex.

branches: 1.34.2; 1.34.4;
to garnish, dust with _KERNEL_OPT

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Don't check if constant-sized KM_SLEEP allocations succeeded.

branches: 1.31.2;
Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Fix a deadlock where one thread exits, enters fstrans_lwp_dtor()
and wants fstrans_lock. This thread holds the proc_lock.
Another thread holds fstrans_lock and runs pserialize_perform().
As the first thread holds the proc_lock, timeouts are blocked and
the second thread blocks forever in kpause().

Change fstrans_lwp_dtor() to invalidate, but not free its info
structs. No need to take fstrans_lock.

Change fstrans_get_lwp_info() to reuse invalidated info before
trying to allocate a new one.

branches: 1.29.2;
change the mountlist CIRCLEQ into a TAILQ

Mark diagnostic-only variables

Replace macro v_specmountpoint with two functions spec_node_getmountedfs()
and spec_node_setmountedfs() to manage the file system mounted on a device.
Assert the device is a block device.

Welcome to 6.99.24

Discussed on tech-kern@ some time ago.

Reviewed by: David Holland <dholland@netbsd.org>

branches: 1.26.2;
Replace the rwlock based implementation with passive serialization
from pserialize(9) and mutex / condvar.

The fast paths (fstrans_start/fstrans_done on a file system not
suspended or suspending and fscow_run with no change pending) now
run without locks or other atomic operations. Suspension and cow
handler insertion and removal is done with mutex / condvars.

The API remains unchanged.

branches: 1.25.12; 1.25.22;
don't forget to skip marker processes.

branches: 1.24.4;
more <sys/buf.h> police

branches: 1.23.2; 1.23.4; 1.23.6;
Replace the fss unmount hook with a vfs_hook.

fssvar.h: struct device * -> device_t.
fss.c: establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c: destroy cow handlers on unmount as fstrans_unmount() will be
called before vfs_hooks.

branches: 1.22.2;
Use pool_cache.

branches: 1.21.2;
Remove a bad assertion from last commit.
Non bufcache buffers may have BC_BUSY unset.

Fscow_run() may recurse into itself.
Take care by adding a per-lwp recursion counter.

branches: 1.19.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.18.2; 1.18.4;
- simplify ASSERT_SLEEPABLE.
- move it from proc.h to systm.h.
- add some more checks.
- make it a little more lkm friendly.

branches: 1.17.2; 1.17.6;
BO_COWDONE -> B_COWDONE: this flag is tested/modified from the thread owning
the buffer and therefore needs no protection by a mutex.

Ok: Andrew Doran <ad@netbsd.org>

Merge vmlocking2 to head.

branches: 1.15.2; 1.15.6;
Fscow_run(): add a flag "bool data_valid" to note still valid data.
Buffers run through copy-on-write are marked B_COWDONE. This condition
is valid until the buffer has run through bwrite() and gets cleared from
biodone().

Welcome to 4.99.39.

Reviewed by: YAMAMOTO Takashi <yamt@netbsd.org>

branches: 1.14.4;
fscow_run(): Check for NULL mount and don't run the cow handler in this case.

Remove an include committed by accident.

From Chris Ross via current-users.

Update the file system copy-on-write handler.

- Instead of hooking the handler on the specdev of a mounted file system
hook directly on the `struct mount'.

- Rename from `vn_cow_*' to `fscow_*' and move to `kern/vfs_trans.c'. Use
`mount_*specific' instead of clobbering `struct mount' or `struct specinfo'.

- Replace the hand-made reader/writer lock with a krwlock.

- Keep `vn_cow_*' functions and mark as obsolete.

- Welcome to NetBSD 4.99.32 - `struct specinfo' changed size.

Reviewed by: Jason Thorpe <thorpej@netbsd.org>

branches: 1.11.4; 1.11.6; 1.11.8; 1.11.10;
Use eopnotsupp() instead of vfs_stdsuspendctl() and retire the latter.

branches: 1.10.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Fstrans_start() always returns zero, so change its type to void.

Use rwlock for fmi_shared_lock and fmi_lazy_lock.

Ok: Andrew Doran <ad@netbsd.org>

Use mutexes/condvars.

branches: 1.6.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.5.2; 1.5.4; 1.5.8;
Make fstrans(9) the default helper for file system suspension.
Replaces the now obsolete vn_start_write()/vn_finished_write().

Replace some uses of lockmgr() / simplelocks.

newlock2: syncer_lock is now a mutex.

branches: 1.2.2;
Change fstrans enum types to upper case.
No functional change.

From Antti Kantee <pooka@netbsd.org>

New file system suspension API to replace vn_start_write and vn_finished_write.
The suspension helpers are now put into file system specific operations.
This means every file system not supporting these helpers cannot be suspended
and therefore snapshots are no longer possible.

Implemented for file systems of type ffs.

The new API is enabled on a kernel option NEWVNGATE. This option is
not enabled by default in any kernel config.

Presented and discussed on tech-kern with much input from
Bill Studenmund <wrstuden@netbsd.org> and YAMAMOTO Takashi <yamt@netbsd.org>.

Welcome to 4.99.9 (new vfs op vfs_suspendctl).

While one thread runs vgone() it is possible for another thread to grab
a "v_mount" that will be freed before it uses this mount for fstrans_start().

Add a hashtab to lookup our private mount data "fstrans_mount_info" and
use "mp" as an opaque key for lookup.

Reported-by: syzbot+54dc9ac0804a97b59bc6@syzkaller.appspotmail.com

Handle IMNT_GONE on the file system we want suspended not its
lowest mount we really suspend.

fstrans(9): KASSERT(a && b) => KASSERT(a); KASSERT(b)

No functional change intended except better diagnostics in case of
crash.

Reorganise the locking and allocation of fstrans_lwp_info slightly, to
reduce contention. "please go ahead" hannken@.

Add operation fstrans_held(struct mount *), true if the current thread
holds a fstrans lock.

Ride 9.99.61

Add an owner field to fstrans mount info and use it to hold
the thread currently suspending this mount.

Remove now unneeded state FSTRANS_EXCL.

It is now possible to suspend a file system from a thread
already holding fstrans locks. Use with care ...

Walk down to the lowest mount for "fli_alias".

Address PR kern/54195 (null mounts: panic: ...).

Add reference counting to alias states to prevent them disappearing
while still in use.

Change "fli_alias" to point to the corresponding "fstrans_lwp_info".

Fix fstrans_clear_lwp_info() list traversal, remove already advanced
the list pointer.

Move pointer to fstrans private data into "struct lwp".

Ride NetBSD 8.99.35

Clear per-lwp entries whose mount is gone before the first return
from fstrans_done().

No longer leaks "struct mount" forever.

Fix bad assertion: vfs_suspend(dead_rootmount) may happen and
must return EOPNOTSUPP.

- Make the fstrans mount info part of the per-lwp state and replace
most accesses to the mount with fstrans mount info.

- Add "fmi_gone" to be true after unmount and add a counter of
outstanding mount infos so fstrans_clear_lwp_info() only runs
if there may be something to do.

- Move lookup of base mounts into per-lwp state.

- Keep a list of valid mounts for DIAGNOSTIC checks.

Move fstrans_unmount() to vfs_rele(), just before it would free the mount.
Don't take a mount reference for fstrans as it gets notified about the release.

Defer the final free of the mount to fstrans_mount_dtor() when fstrans
has released all references to this mount. Prevents the mount's memory
to be reused as a new mount before fstrans released all references.

Address PR kern/53928 modules/t_builtin:disable test case randomly fails.

Attach "mnt_transinfo" to "dead_rootmount" so every mount has a
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.

Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.

Bring back three state file system suspension:

NORMAL -> SUSPENDING -> SUSPENDED

and add operation fstrans_start_lazy() that only blocks while SUSPENDED.

Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().

PR kern/53624 (dom0 freeze on domU exit)

Back out sftchg/fstcnt deadlock workaround

The change did prevent some system freeze, but caused spurious
unmount failures reporter by bouyer@.

hannken@ is working on the right fix, see kern/53624

Work around deadlock between fstchg and fstcnt

When suspending a filesystem in fstrans_setstate(), we wait on
fstcnt for threads to finish transactions. While we do this, any
thread trying to start a filesystem transaction will wait on fstchg
in fstrans_start(), a situation which can deadlock.

The wait for fstcnt in fstrans_setstate() can be interrupted by
a signal, but the wait for fstchg in fstrans_start() cannot. Once
most processes are stuck in fstchg, it is impossible to send a
signal to the thread that waits on fstcnt, because no process
respond anymore to user input.

We fix that by adding a timeout to the wait on fstcnt in
fstrans_setstate(). This means suspending a filesystem may fail,
but it was already the case when the sleep was interupted by
a signal, hence calling function must already handle a possible
failure.

Fixes kern/53624

branches: 1.48.4; 1.48.6;
Make the fast path of fstrans_get_lwp_info() "static inline".

Clear fstrans entries whose mount is gone from the last fstrans_done() only.

Operations fstrans_start() and fstrans_start_nowait() now always
use FSTRANS_SHARED as lock type so remove the lock type argument.

File system state FSTRANS_SUSPENDING is now unused so remove it.

Regen vnode_if files.

Ride 8.99.1 less than a hour ago.

branches: 1.45.2;
Move fstrans initialization to vfs_mountalloc().

Handle the case where the mount is gone and its mnt_transinfo is NULL.

branches: 1.43.2;
Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch fstrans_dump() to _mountlist_next().

Change _fstrans_start() to allocate per lwp info for layered file
systems to get a reference on the mount.

Set mnt_lower on successfull mount only.

Always use the lowest mount for fstrans and suspend. This way we
enter/leave or suspend/resume the stack of layered file systems as a unit.

Add an operation to test a mount for fstrans support and use it for
_fstrans_start(), fstrans_done(), fstrans_is_owner(), vfs_suspend()
and vfs_resume().

Test for fstrans support before ASSERT_SLEEPABLE().

Test for fstrans support before trying to allocate per-thread info.

PR kern/51996 (kmem_alloc called from intr context in fstrans_get_lwp_info)

Let syncer try fstrans_start() before running VFS_SYNC() to get rid
of the syncer lock/unlock from vfs_suspend().

Protect attaching and detaching lwp_info to mount with a mutex.

branches: 1.34.2; 1.34.4;
to garnish, dust with _KERNEL_OPT

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Don't check if constant-sized KM_SLEEP allocations succeeded.

branches: 1.31.2;
Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Fix a deadlock where one thread exits, enters fstrans_lwp_dtor()
and wants fstrans_lock. This thread holds the proc_lock.
Another thread holds fstrans_lock and runs pserialize_perform().
As the first thread holds the proc_lock, timeouts are blocked and
the second thread blocks forever in kpause().

Change fstrans_lwp_dtor() to invalidate, but not free its info
structs. No need to take fstrans_lock.

Change fstrans_get_lwp_info() to reuse invalidated info before
trying to allocate a new one.

branches: 1.29.2;
change the mountlist CIRCLEQ into a TAILQ

Mark diagnostic-only variables

Replace macro v_specmountpoint with two functions spec_node_getmountedfs()
and spec_node_setmountedfs() to manage the file system mounted on a device.
Assert the device is a block device.

Welcome to 6.99.24

Discussed on tech-kern@ some time ago.

Reviewed by: David Holland <dholland@netbsd.org>

branches: 1.26.2;
Replace the rwlock based implementation with passive serialization
from pserialize(9) and mutex / condvar.

The fast paths (fstrans_start/fstrans_done on a file system not
suspended or suspending and fscow_run with no change pending) now
run without locks or other atomic operations. Suspension and cow
handler insertion and removal is done with mutex / condvars.

The API remains unchanged.

branches: 1.25.12; 1.25.22;
don't forget to skip marker processes.

branches: 1.24.4;
more <sys/buf.h> police

branches: 1.23.2; 1.23.4; 1.23.6;
Replace the fss unmount hook with a vfs_hook.

fssvar.h: struct device * -> device_t.
fss.c: establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c: destroy cow handlers on unmount as fstrans_unmount() will be
called before vfs_hooks.

branches: 1.22.2;
Use pool_cache.

branches: 1.21.2;
Remove a bad assertion from last commit.
Non bufcache buffers may have BC_BUSY unset.

Fscow_run() may recurse into itself.
Take care by adding a per-lwp recursion counter.

branches: 1.19.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.18.2; 1.18.4;
- simplify ASSERT_SLEEPABLE.
- move it from proc.h to systm.h.
- add some more checks.
- make it a little more lkm friendly.

branches: 1.17.2; 1.17.6;
BO_COWDONE -> B_COWDONE: this flag is tested/modified from the thread owning
the buffer and therefore needs no protection by a mutex.

Ok: Andrew Doran <ad@netbsd.org>

Merge vmlocking2 to head.

branches: 1.15.2; 1.15.6;
Fscow_run(): add a flag "bool data_valid" to note still valid data.
Buffers run through copy-on-write are marked B_COWDONE. This condition
is valid until the buffer has run through bwrite() and gets cleared from
biodone().

Welcome to 4.99.39.

Reviewed by: YAMAMOTO Takashi <yamt@netbsd.org>

branches: 1.14.4;
fscow_run(): Check for NULL mount and don't run the cow handler in this case.

Remove an include committed by accident.

From Chris Ross via current-users.

Update the file system copy-on-write handler.

- Instead of hooking the handler on the specdev of a mounted file system
hook directly on the `struct mount'.

- Rename from `vn_cow_*' to `fscow_*' and move to `kern/vfs_trans.c'. Use
`mount_*specific' instead of clobbering `struct mount' or `struct specinfo'.

- Replace the hand-made reader/writer lock with a krwlock.

- Keep `vn_cow_*' functions and mark as obsolete.

- Welcome to NetBSD 4.99.32 - `struct specinfo' changed size.

Reviewed by: Jason Thorpe <thorpej@netbsd.org>

branches: 1.11.4; 1.11.6; 1.11.8; 1.11.10;
Use eopnotsupp() instead of vfs_stdsuspendctl() and retire the latter.

branches: 1.10.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Fstrans_start() always returns zero, so change its type to void.

Use rwlock for fmi_shared_lock and fmi_lazy_lock.

Ok: Andrew Doran <ad@netbsd.org>

Use mutexes/condvars.

branches: 1.6.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.5.2; 1.5.4; 1.5.8;
Make fstrans(9) the default helper for file system suspension.
Replaces the now obsolete vn_start_write()/vn_finished_write().

Replace some uses of lockmgr() / simplelocks.

newlock2: syncer_lock is now a mutex.

branches: 1.2.2;
Change fstrans enum types to upper case.
No functional change.

From Antti Kantee <pooka@netbsd.org>

New file system suspension API to replace vn_start_write and vn_finished_write.
The suspension helpers are now put into file system specific operations.
This means every file system not supporting these helpers cannot be suspended
and therefore snapshots are no longer possible.

Implemented for file systems of type ffs.

The new API is enabled on a kernel option NEWVNGATE. This option is
not enabled by default in any kernel config.

Presented and discussed on tech-kern with much input from
Bill Studenmund <wrstuden@netbsd.org> and YAMAMOTO Takashi <yamt@netbsd.org>.

Welcome to 4.99.9 (new vfs op vfs_suspendctl).

fstrans(9): KASSERT(a && b) => KASSERT(a); KASSERT(b)

No functional change intended except better diagnostics in case of
crash.

Reorganise the locking and allocation of fstrans_lwp_info slightly, to
reduce contention. "please go ahead" hannken@.

Add operation fstrans_held(struct mount *), true if the current thread
holds a fstrans lock.

Ride 9.99.61

Add an owner field to fstrans mount info and use it to hold
the thread currently suspending this mount.

Remove now unneeded state FSTRANS_EXCL.

It is now possible to suspend a file system from a thread
already holding fstrans locks. Use with care ...

Walk down to the lowest mount for "fli_alias".

Address PR kern/54195 (null mounts: panic: ...).

Add reference counting to alias states to prevent them disappearing
while still in use.

Change "fli_alias" to point to the corresponding "fstrans_lwp_info".

Fix fstrans_clear_lwp_info() list traversal, remove already advanced
the list pointer.

Move pointer to fstrans private data into "struct lwp".

Ride NetBSD 8.99.35

Clear per-lwp entries whose mount is gone before the first return
from fstrans_done().

No longer leaks "struct mount" forever.

Fix bad assertion: vfs_suspend(dead_rootmount) may happen and
must return EOPNOTSUPP.

- Make the fstrans mount info part of the per-lwp state and replace
most accesses to the mount with fstrans mount info.

- Add "fmi_gone" to be true after unmount and add a counter of
outstanding mount infos so fstrans_clear_lwp_info() only runs
if there may be something to do.

- Move lookup of base mounts into per-lwp state.

- Keep a list of valid mounts for DIAGNOSTIC checks.

Move fstrans_unmount() to vfs_rele(), just before it would free the mount.
Don't take a mount reference for fstrans as it gets notified about the release.

Defer the final free of the mount to fstrans_mount_dtor() when fstrans
has released all references to this mount. Prevents the mount's memory
to be reused as a new mount before fstrans released all references.

Address PR kern/53928 modules/t_builtin:disable test case randomly fails.

Attach "mnt_transinfo" to "dead_rootmount" so every mount has a
valid "mnt_transinfo" and remove now unneeded flag IMNT_HAS_TRANS.

Run fstrans_start()/fstrans_done() on dead_rootmount if FSTRANS_DEAD_ENABLED.
Should become the default for DIAGNOSTIC in the future.

Bring back three state file system suspension:

NORMAL -> SUSPENDING -> SUSPENDED

and add operation fstrans_start_lazy() that only blocks while SUSPENDED.

Change vndthread() support operation handle_with_rdwr() to bracket
its file system operations by fstrans_start_lazy() and fstrans_done().

PR kern/53624 (dom0 freeze on domU exit)

Back out sftchg/fstcnt deadlock workaround

The change did prevent some system freeze, but caused spurious
unmount failures reporter by bouyer@.

hannken@ is working on the right fix, see kern/53624

Work around deadlock between fstchg and fstcnt

When suspending a filesystem in fstrans_setstate(), we wait on
fstcnt for threads to finish transactions. While we do this, any
thread trying to start a filesystem transaction will wait on fstchg
in fstrans_start(), a situation which can deadlock.

The wait for fstcnt in fstrans_setstate() can be interrupted by
a signal, but the wait for fstchg in fstrans_start() cannot. Once
most processes are stuck in fstchg, it is impossible to send a
signal to the thread that waits on fstcnt, because no process
respond anymore to user input.

We fix that by adding a timeout to the wait on fstcnt in
fstrans_setstate(). This means suspending a filesystem may fail,
but it was already the case when the sleep was interupted by
a signal, hence calling function must already handle a possible
failure.

Fixes kern/53624

branches: 1.48.4; 1.48.6;
Make the fast path of fstrans_get_lwp_info() "static inline".

Clear fstrans entries whose mount is gone from the last fstrans_done() only.

Operations fstrans_start() and fstrans_start_nowait() now always
use FSTRANS_SHARED as lock type so remove the lock type argument.

File system state FSTRANS_SUSPENDING is now unused so remove it.

Regen vnode_if files.

Ride 8.99.1 less than a hour ago.

branches: 1.45.2;
Move fstrans initialization to vfs_mountalloc().

Handle the case where the mount is gone and its mnt_transinfo is NULL.

branches: 1.43.2;
Remove unused argument "nextp" from vfs_busy() and vfs_unbusy().
Remove argument "keepref" from vfs_unbusy() and add vfs_ref() where needed.

Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

Switch fstrans_dump() to _mountlist_next().

Change _fstrans_start() to allocate per lwp info for layered file
systems to get a reference on the mount.

Set mnt_lower on successfull mount only.

Always use the lowest mount for fstrans and suspend. This way we
enter/leave or suspend/resume the stack of layered file systems as a unit.

Add an operation to test a mount for fstrans support and use it for
_fstrans_start(), fstrans_done(), fstrans_is_owner(), vfs_suspend()
and vfs_resume().

Test for fstrans support before ASSERT_SLEEPABLE().

Test for fstrans support before trying to allocate per-thread info.

PR kern/51996 (kmem_alloc called from intr context in fstrans_get_lwp_info)

Let syncer try fstrans_start() before running VFS_SYNC() to get rid
of the syncer lock/unlock from vfs_suspend().

Protect attaching and detaching lwp_info to mount with a mutex.

branches: 1.34.2; 1.34.4;
to garnish, dust with _KERNEL_OPT

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

Don't check if constant-sized KM_SLEEP allocations succeeded.

branches: 1.31.2;
Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

Fix a deadlock where one thread exits, enters fstrans_lwp_dtor()
and wants fstrans_lock. This thread holds the proc_lock.
Another thread holds fstrans_lock and runs pserialize_perform().
As the first thread holds the proc_lock, timeouts are blocked and
the second thread blocks forever in kpause().

Change fstrans_lwp_dtor() to invalidate, but not free its info
structs. No need to take fstrans_lock.

Change fstrans_get_lwp_info() to reuse invalidated info before
trying to allocate a new one.

branches: 1.29.2;
change the mountlist CIRCLEQ into a TAILQ

Mark diagnostic-only variables

Replace macro v_specmountpoint with two functions spec_node_getmountedfs()
and spec_node_setmountedfs() to manage the file system mounted on a device.
Assert the device is a block device.

Welcome to 6.99.24

Discussed on tech-kern@ some time ago.

Reviewed by: David Holland <dholland@netbsd.org>

branches: 1.26.2;
Replace the rwlock based implementation with passive serialization
from pserialize(9) and mutex / condvar.

The fast paths (fstrans_start/fstrans_done on a file system not
suspended or suspending and fscow_run with no change pending) now
run without locks or other atomic operations. Suspension and cow
handler insertion and removal is done with mutex / condvars.

The API remains unchanged.

branches: 1.25.12; 1.25.22;
don't forget to skip marker processes.

branches: 1.24.4;
more <sys/buf.h> police

branches: 1.23.2; 1.23.4; 1.23.6;
Replace the fss unmount hook with a vfs_hook.

fssvar.h: struct device * -> device_t.
fss.c: establish unmount hook on first attach, remove on last detach.
vfs_syscalls.c: remove the call of fss_umount_hook().
vfs_trans.c: destroy cow handlers on unmount as fstrans_unmount() will be
called before vfs_hooks.

branches: 1.22.2;
Use pool_cache.

branches: 1.21.2;
Remove a bad assertion from last commit.
Non bufcache buffers may have BC_BUSY unset.

Fscow_run() may recurse into itself.
Take care by adding a per-lwp recursion counter.

branches: 1.19.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.18.2; 1.18.4;
- simplify ASSERT_SLEEPABLE.
- move it from proc.h to systm.h.
- add some more checks.
- make it a little more lkm friendly.

branches: 1.17.2; 1.17.6;
BO_COWDONE -> B_COWDONE: this flag is tested/modified from the thread owning
the buffer and therefore needs no protection by a mutex.

Ok: Andrew Doran <ad@netbsd.org>