Remove Softdep.

Softdep has been a no-op for some time now, this removes it to get
it out of the way.

Flensing mostly done in Talinn, with some help from krw@

ok deraadt@

Delete support for FFS filesystems before the in-inode symlink
optimization. As observed by ali_farzanrad(at)riseup.net, support
for these was broken in the 5.5 release in early 2014 by the time_t
changes. No one noticed before now, so clearly this isn't something
we need to continue to support; rejecting in ffs_validate() is an
improvement.

Also: simplify DIRSIZ(), drop OLDDIRFMT and NEWDIRFMT, tests of
fs_maxsymlinklen against zero, #ifdef tests of FS_44INODEFMT, and
remove support for newfs -O0, last used in 2016.

ok miod@

spelling
ok jmc@

Do not dereference `vp' after vput(9)ing it.

From dholland@NetBSD

ok anton@

Nope, the right byte layout is happening, but we still need to figure out
a reported baddir panic. Discussed with guenther tedu kettenis millert..

For filenames which are a multiple of 4 bytes long, the zero pad is
incorrectly placed underneath the last 4 bytes (and then overwritten)
rather than afterwards.
We got confused and followed FreeBSD's lead, which curiously increased
the leakage of kernel stack from 3 bytes to 4...
ok millert kettenis

3 bytes of kernel stack address space were leaked into on-disk directories.
With some gritty work up to 254 bytes can be discovered. More details at
https://svnweb.freebsd.org/changeset/base/347066
The impact on OpenBSD is very limited:
1 - such stack bytes can be found in raw-device reads, from group operator.
If you can read the raw disks you can undertake other more powerful actions.
2 - read(2) upon directory fd was disabled July 1997 because I didn't like
how grep * would display garbage and mess up the tty, and applying vis(3)
for just directory reads seemed silly. read(2) was changed to return
0 (EOF). Sep 2016 this was further changed to EISDIR, so you still cannot
see the bad bytes.
3 - In 2013 when guenther adapted the getdents(2) directory-reading system
call to 64-bit ino_t, the userland data format changed to 8-byte-alignment,
making it incompatible with the 4-byte-alignment UFS on-disk format. As
a result of code refactoring the bad bytes were not copied to userland.
Bad bytes will remain in old directories on old filesystems, but nothing makes
those bytes user visible. There will be no errata or syspatch issued. I
urge other systems which do expose the information to userland to issue
errata quickly, since this is a 254 byte infoleak of the stack which is great
for ROP-chain building to attack some other bug. Especially if the kernel
has no layout/link-order randomization ...
ok kettenis jca millert otto ...

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

Integrate new ext2fs, reverting ufs support for the old one.

Cleanup exec

From NetBSD: update to 960217 sources

branches: 1.1.1;
Initial revision

Delete support for FFS filesystems before the in-inode symlink
optimization. As observed by ali_farzanrad(at)riseup.net, support
for these was broken in the 5.5 release in early 2014 by the time_t
changes. No one noticed before now, so clearly this isn't something
we need to continue to support; rejecting in ffs_validate() is an
improvement.

Also: simplify DIRSIZ(), drop OLDDIRFMT and NEWDIRFMT, tests of
fs_maxsymlinklen against zero, #ifdef tests of FS_44INODEFMT, and
remove support for newfs -O0, last used in 2016.

ok miod@

spelling
ok jmc@

Do not dereference `vp' after vput(9)ing it.

From dholland@NetBSD

ok anton@

Nope, the right byte layout is happening, but we still need to figure out
a reported baddir panic. Discussed with guenther tedu kettenis millert..

For filenames which are a multiple of 4 bytes long, the zero pad is
incorrectly placed underneath the last 4 bytes (and then overwritten)
rather than afterwards.
We got confused and followed FreeBSD's lead, which curiously increased
the leakage of kernel stack from 3 bytes to 4...
ok millert kettenis

3 bytes of kernel stack address space were leaked into on-disk directories.
With some gritty work up to 254 bytes can be discovered. More details at
https://svnweb.freebsd.org/changeset/base/347066
The impact on OpenBSD is very limited:
1 - such stack bytes can be found in raw-device reads, from group operator.
If you can read the raw disks you can undertake other more powerful actions.
2 - read(2) upon directory fd was disabled July 1997 because I didn't like
how grep * would display garbage and mess up the tty, and applying vis(3)
for just directory reads seemed silly. read(2) was changed to return
0 (EOF). Sep 2016 this was further changed to EISDIR, so you still cannot
see the bad bytes.
3 - In 2013 when guenther adapted the getdents(2) directory-reading system
call to 64-bit ino_t, the userland data format changed to 8-byte-alignment,
making it incompatible with the 4-byte-alignment UFS on-disk format. As
a result of code refactoring the bad bytes were not copied to userland.
Bad bytes will remain in old directories on old filesystems, but nothing makes
those bytes user visible. There will be no errata or syspatch issued. I
urge other systems which do expose the information to userland to issue
errata quickly, since this is a 254 byte infoleak of the stack which is great
for ROP-chain building to attack some other bug. Especially if the kernel
has no layout/link-order randomization ...
ok kettenis jca millert otto ...

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

Integrate new ext2fs, reverting ufs support for the old one.

Cleanup exec

From NetBSD: update to 960217 sources

branches: 1.1.1;
Initial revision

spelling
ok jmc@

Do not dereference `vp' after vput(9)ing it.

From dholland@NetBSD

ok anton@

Nope, the right byte layout is happening, but we still need to figure out
a reported baddir panic. Discussed with guenther tedu kettenis millert..

For filenames which are a multiple of 4 bytes long, the zero pad is
incorrectly placed underneath the last 4 bytes (and then overwritten)
rather than afterwards.
We got confused and followed FreeBSD's lead, which curiously increased
the leakage of kernel stack from 3 bytes to 4...
ok millert kettenis

3 bytes of kernel stack address space were leaked into on-disk directories.
With some gritty work up to 254 bytes can be discovered. More details at
https://svnweb.freebsd.org/changeset/base/347066
The impact on OpenBSD is very limited:
1 - such stack bytes can be found in raw-device reads, from group operator.
If you can read the raw disks you can undertake other more powerful actions.
2 - read(2) upon directory fd was disabled July 1997 because I didn't like
how grep * would display garbage and mess up the tty, and applying vis(3)
for just directory reads seemed silly. read(2) was changed to return
0 (EOF). Sep 2016 this was further changed to EISDIR, so you still cannot
see the bad bytes.
3 - In 2013 when guenther adapted the getdents(2) directory-reading system
call to 64-bit ino_t, the userland data format changed to 8-byte-alignment,
making it incompatible with the 4-byte-alignment UFS on-disk format. As
a result of code refactoring the bad bytes were not copied to userland.
Bad bytes will remain in old directories on old filesystems, but nothing makes
those bytes user visible. There will be no errata or syspatch issued. I
urge other systems which do expose the information to userland to issue
errata quickly, since this is a 254 byte infoleak of the stack which is great
for ROP-chain building to attack some other bug. Especially if the kernel
has no layout/link-order randomization ...
ok kettenis jca millert otto ...

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

Integrate new ext2fs, reverting ufs support for the old one.

Cleanup exec

From NetBSD: update to 960217 sources

branches: 1.1.1;
Initial revision

Do not dereference `vp' after vput(9)ing it.

From dholland@NetBSD

ok anton@

Nope, the right byte layout is happening, but we still need to figure out
a reported baddir panic. Discussed with guenther tedu kettenis millert..

For filenames which are a multiple of 4 bytes long, the zero pad is
incorrectly placed underneath the last 4 bytes (and then overwritten)
rather than afterwards.
We got confused and followed FreeBSD's lead, which curiously increased
the leakage of kernel stack from 3 bytes to 4...
ok millert kettenis

3 bytes of kernel stack address space were leaked into on-disk directories.
With some gritty work up to 254 bytes can be discovered. More details at
https://svnweb.freebsd.org/changeset/base/347066
The impact on OpenBSD is very limited:
1 - such stack bytes can be found in raw-device reads, from group operator.
If you can read the raw disks you can undertake other more powerful actions.
2 - read(2) upon directory fd was disabled July 1997 because I didn't like
how grep * would display garbage and mess up the tty, and applying vis(3)
for just directory reads seemed silly. read(2) was changed to return
0 (EOF). Sep 2016 this was further changed to EISDIR, so you still cannot
see the bad bytes.
3 - In 2013 when guenther adapted the getdents(2) directory-reading system
call to 64-bit ino_t, the userland data format changed to 8-byte-alignment,
making it incompatible with the 4-byte-alignment UFS on-disk format. As
a result of code refactoring the bad bytes were not copied to userland.
Bad bytes will remain in old directories on old filesystems, but nothing makes
those bytes user visible. There will be no errata or syspatch issued. I
urge other systems which do expose the information to userland to issue
errata quickly, since this is a 254 byte infoleak of the stack which is great
for ROP-chain building to attack some other bug. Especially if the kernel
has no layout/link-order randomization ...
ok kettenis jca millert otto ...

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

Integrate new ext2fs, reverting ufs support for the old one.

Cleanup exec

From NetBSD: update to 960217 sources

branches: 1.1.1;
Initial revision

Nope, the right byte layout is happening, but we still need to figure out
a reported baddir panic. Discussed with guenther tedu kettenis millert..

For filenames which are a multiple of 4 bytes long, the zero pad is
incorrectly placed underneath the last 4 bytes (and then overwritten)
rather than afterwards.
We got confused and followed FreeBSD's lead, which curiously increased
the leakage of kernel stack from 3 bytes to 4...
ok millert kettenis

3 bytes of kernel stack address space were leaked into on-disk directories.
With some gritty work up to 254 bytes can be discovered. More details at
https://svnweb.freebsd.org/changeset/base/347066
The impact on OpenBSD is very limited:
1 - such stack bytes can be found in raw-device reads, from group operator.
If you can read the raw disks you can undertake other more powerful actions.
2 - read(2) upon directory fd was disabled July 1997 because I didn't like
how grep * would display garbage and mess up the tty, and applying vis(3)
for just directory reads seemed silly. read(2) was changed to return
0 (EOF). Sep 2016 this was further changed to EISDIR, so you still cannot
see the bad bytes.
3 - In 2013 when guenther adapted the getdents(2) directory-reading system
call to 64-bit ino_t, the userland data format changed to 8-byte-alignment,
making it incompatible with the 4-byte-alignment UFS on-disk format. As
a result of code refactoring the bad bytes were not copied to userland.
Bad bytes will remain in old directories on old filesystems, but nothing makes
those bytes user visible. There will be no errata or syspatch issued. I
urge other systems which do expose the information to userland to issue
errata quickly, since this is a 254 byte infoleak of the stack which is great
for ROP-chain building to attack some other bug. Especially if the kernel
has no layout/link-order randomization ...
ok kettenis jca millert otto ...

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

Integrate new ext2fs, reverting ufs support for the old one.

Cleanup exec

From NetBSD: update to 960217 sources

branches: 1.1.1;
Initial revision

3 bytes of kernel stack address space were leaked into on-disk directories.
With some gritty work up to 254 bytes can be discovered. More details at
https://svnweb.freebsd.org/changeset/base/347066
The impact on OpenBSD is very limited:
1 - such stack bytes can be found in raw-device reads, from group operator.
If you can read the raw disks you can undertake other more powerful actions.
2 - read(2) upon directory fd was disabled July 1997 because I didn't like
how grep * would display garbage and mess up the tty, and applying vis(3)
for just directory reads seemed silly. read(2) was changed to return
0 (EOF). Sep 2016 this was further changed to EISDIR, so you still cannot
see the bad bytes.
3 - In 2013 when guenther adapted the getdents(2) directory-reading system
call to 64-bit ino_t, the userland data format changed to 8-byte-alignment,
making it incompatible with the 4-byte-alignment UFS on-disk format. As
a result of code refactoring the bad bytes were not copied to userland.
Bad bytes will remain in old directories on old filesystems, but nothing makes
those bytes user visible. There will be no errata or syspatch issued. I
urge other systems which do expose the information to userland to issue
errata quickly, since this is a 254 byte infoleak of the stack which is great
for ROP-chain building to attack some other bug. Especially if the kernel
has no layout/link-order randomization ...
ok kettenis jca millert otto ...

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.

Updates for VFS Lite 2 + soft update.

back out vfs lite2 till after 2.2

VFS Lite2 Changes

Integrate new ext2fs, reverting ufs support for the old one.

Cleanup exec

From NetBSD: update to 960217 sources

branches: 1.1.1;
Initial revision

Rectify some issues with the noperm mount flag; the root vnode was not
protected properly and files without any x bit set were accidentaly considered
executable when checked with access(2).

Issues found and reported by deraadt, halex, reyk, tb
ok deraadt

fix whitespace

Remove proc from the parameters of vn_lock(). The parameter is
unnecessary because curproc always does the locking.

OK mpi@

Clean up the parameters of VOP_LOCK() and VOP_UNLOCK(). It is always
curproc that does the locking or unlocking, so the proc parameter
is pointless and can be dropped.

OK mpi@, deraadt@

Add a noperm mount flag for FFS to be used for building release sets
without root privileges. This is only the kernel/mount flag; additional
work in the build Makefile's will be necessary such that the files in
$DESTDIR are created with correct permissions.

tedu couldn't find anything wrong with it in a quick review
idea & ok deraadt

Remove the unused flags argument from VOP_UNLOCK().

torture tested on amd64, i386 and macppc
ok beck mpi stefan
"the change looks right" deraadt

Move mnt_maxsymlink from struct mount to struct ufsmount.

The concept of differentiating between "short" and "long" symlinks is
specific to ufs/, so it shouldn't creep into the generic fs layer.
Inspired by a similar commit to NetBSD.

While there replace all references to mnt_maxsymlinklen in ufs/ext2fs
with EXT2_MAXSYMLINKLEN, which is the constant max short symlink len for
ext2fs. This allows to get rid of some (mnt_maxsymlinklen == 0) checks
there, which is always false for ext2fs.

input and ok stefan@
ok millert@

Remove some includes include-what-you-use claims don't
have any direct symbols used. Tested for indirect use by compiling
amd64/i386/sparc64 kernels.

ok tedu@ deraadt@

don't truncate the dirhash if ufs truncate fails.
adapted from a freebsd commit by david hill

decouple struct uvmexp into a new file, so that uvm_extern.h and sysctl.h
don't need to be married.
ok guenther miod beck jsing kettenis

bcmp -> memcmp

replace old bcopy/bzero with standard functions. ok kettenis

UFS does't do inode numbers >2^32, so use a smaller type internally,
only using ino_t in the VFS layer APIs: vget, readdir, getattr.

otto wrote the original diff for libsa to keep bootblock from overflowing
ok deraadt@ kettenis@

Fix more printf format string bugs in sys/ufs.
ok miod

The only sensible argument for VOP_* calls that take a struct proc pointer is
curproc. A bunch of callers were passing in 0 (not even NULL, 0) as this
pointer, which was fine until the called vnode function tried to do
something with it. Typically, this code was then copy/pasted to various
parts of the tree.

Accept the facts of life and switch all of these over to passing curproc
for now until the argument can be removed.

Discovered by stsp trying to create a softraid on top of a vnd, which
crashed with a NULL deref in vndioctl.

softraid bits tested by mikeb and jsing. raidframe bits tested by pea,
matthieu and naddy. The rest tested by at least thib, jsing and myself.

ok thib@, jsing@.

remove proc.h include from uvm_map.h. This has far reaching effects, as
sysctl.h was reliant on this particular include, and many drivers included
sysctl.h unnecessarily. remove sysctl.h or add proc.h as needed.
ok deraadt

Remove the VREF() macro and replaces all instances with a call to verf(),
which is exactly what the macro does.

Macro's that are nothing more then:
#define FUNCTION(arg) function(arg)
are almost always pointless and should go away.

OK blambert@
Agreed by many.

pedro ok'd this ~3500 line diff which removes the vop argument
"ap = v" comments in under 8 seconds, so it must be ok. and it compiles
too.

There is no need to set IN_CHANGE or IN_UPDATE when no on-disk data is
being touched, fixes PR 3634, okay mickey@, thib@ and beck@.

Use the DIP macros to uniformly access fields from UFS1 and UFS2 dinodes.
No functional change, okay tedu@.

Use ANSI function declarations and deregister, no binary change.
Diff from Rui Reis <rui@rui.cx>, thanks.

Reintroduce the changes made by tedu in revision 1.50 of ffs_softdep.c,
this time with a small tweak: when flushing the dependencies, don't
update the inode twice, but update once, and then, if needed, fsync it.
Doing so fixes the inode hangs some people were seeing.

Various testing for a while, especially krw@ and millert@, okay deraadt@

Extended Attributes was a piece to get to ACLs, however ACLs have not
been worked on, so EA is pointless. Also the code is not enabled
in GENERIC so it is not being tested or maintained.

wrap a goto label in the proper #ifdef

Remove remaining whiteout tentacles; OK deraadt@ miod@ weingart@

Tweak softdep_change_linkcnt() so we can specify whether we're willing
to be co-opted by softdep or not, and use this new interface to inform
softdep in ufs_inactive() that the inode mode has changed.

We don't want to be co-opted there as that might lead to undesired
circular dependencies such as a vput() depending on another vput() to
complete, or a process that is trying to free up a vnode being blocked
trying to acquire a new vnode.

Okay tedu@ deraadt@, thanks to all those who tested.

prev softdep merge could lead to inode wait deadlock for unknown reasons.
revert.

fatty softdep merge with freebsd. fixes a variety of possible issues.
relevant changes to ffs_softdep.c were 1.95, 1.96, 1.97, 1.98, 1.103, and
1.107 in freebsd. testing marc and otto. ok deraadt

fix niklas's panic and pr3672 with freebsd rev 1.54 (don't trust DIRSIZ)
extra testing otto@ sturm@ tdeval@

branches: 1.25.2;
back out vnode parents. weird breakge found in ports tree

keep track of a vnode's parent dir. ufs only, and unused atm, but
the fun stuff is coming. testing by brad.

add ian dowse's dirhash code from freebsd.
by building a hash table for large directories, lookups and deletions
become about constant time. this is an excellent improvement for dirs with
10k or more files.
some more cleanup to come, but the code works.
enabled with option UFS_DIRHASH
testing brad millert otto

Remove the advertising clause in the UCB license which Berkeley
rescinded 22 July 1999. Proofed by myself and Theo.

Remove commons; inspired by netbsd.

File system locking fixups, mostly from NetBSD:
- cache_lookup
move common code from various fs's here
always return with vnode and parent locked
adjust return codes
- PDIRUNLOCK - new flag set if lookup couldn't lock parent vnode
- kernfs and procfs
lock vnode in get_root
don't unlock (again) in kernfs_freevp
fix memory leak in procfs

From tedu@stanford.edu
deraadt@ and various other ok

Extended Attribute support from FreeBSD/TrustedBSD ok art@, deraadt@

branches: 1.18.2;
Replace inclusion of <vm/foo.h> with the correct <uvm/bar.h> when necessary.
(Look ma, I might have broken the tree)

Remove old vm.

Privatize several vnode operations that are not used by the generic code.

Cosmetic fixes.
From FreeBSD, through NetBSD.

Move a brelse to after the last access to bp->b_data.
I found this in 1998. Why didn't I commit it then?

Latest soft updates from FreeBSD/Kirk McKusick

Snapshot-related code has been commented out.

branches: 1.12.6;
compat with uvm vnode pager

Return EINVAL when msg_iovlen or iovcnt <= 0; Make uio_resid unsigned (size_t) and don't return EINVAL if it is < 0 in sys_{read,write}. Remove check for uio_resid < 0 uiomove() now that uio_resid is unsigned and brack remaining panics with #ifdef DIAGNOSTIC. vn_rdwr() must now take a size_t * as its 9th argument so change that and clean up uses of vn_rdwr(). Fixes 549 + more

Fix rename in a better way

Earlier patch broke rename. Disalbed it temporarily as I search for a solution.

Unlock child temporarily while truncating directory. This prevents
a double locking bug in the soft updates code.