Add physical sector and alignment info to struct disk_geom and the
geometry plist, and handle in partutil.

Bump version for disk_geom addition.

Collect DIOCGSECTORALIGN handling into one place.

Ensure dsa_firstaligned returned from DIOCGSECTORALIGN is actually the first

branches: 1.171.6;
dk(4): Add locking notes.

dk(4): Explain why no need for device reference in dksize, dkdump.

dk(4): Strengthen preconditions of various devsw operations.

These can only happen between dkopen and dkclose, so there's no need
to test -- we can assert instead that the wedge exists and is fully
initialized.

dk(4): Strengthen dkclose preconditions.

Like dkopen, except it is possible for this to be called after the
wedge has transitioned to dying.

XXX sc_state read here races with sc_state write in dkwedge_detach.
Could change this to atomic_load/store.

dk(4): Strengthen dkopen preconditions.

This cannot be called before dkwedge_attach for the same unit
returns, so sc->sc_dev is guaranteed to be set to a nonnull device_t
and the state is guaranteed not to be larval.

And this cannot be called concurrently with dkwedge_detach, or after
dkwedge_detach does vdevgone until another wedge with the same number
is attached (which can't happen until dkwedge_detach completes), so
the state is guaranteed not to be dying or dead.

Hence sc->sc_dev != NULL and sc->sc_state == DKW_STATE_RUNNING.

dk(4): Prevent race between dkwedge_get_parent_name and wedge detach.

Still races with parent detach but maybe this is better.

XXX Maybe we should ditch dkwedge_get_parent_name -- it's used only
by rf_containsboot, which kinda suggests it shouldn't exist.

dk(4): Split unsafe lookups into safe subroutines and unsafe wrappers.

No functional change intended.

Eventually we should adjust the callers to use the safe subroutines
instead and device_release when done.

dk(4): Don't hold lock around uiomove in dkwedge_list.

Instead, hold a device reference. dkwedge_detach will not run until
the device reference is released.

dk(4): Skip larval wedges in various lookup routines.

These have not yet finished a concurent dkwedge_attach, so there's
nothing we can safely do with them. Just pretend they don't exist --
as if we had arrived at the lookup a moment earlier.

dk(4): Simplify dkwedge_delall by detaching directly.

No need for O(n^2) algorithm and potentially racy lookups -- not that
n is large enough for n^2 to matter, but the mechanism is simpler
this way.

dk(4): Use device_lookup_private for dkwedge_lookup.

No longer necessary to go through the dkwedges array.

Currently device_lookup_private still involves touching other global
locks, but that will change eventually to a lockless pserialized fast
path.

dk(4): dkunit is no longer needed; nix it.

dkwedges array indexing now coincides with autoconf device numbering.

dk(4): Use config_attach_pseudo_acquire to create wedges.

This way, indexing of the dkwedges array coincides with numbering of
autoconf dk(4) instances.

As a side effect, this plugs a race in dkwedge_add with concurrent
drvctl -r. There are a lot of such races in dk(4) left -- to be
addressed with more device references.

dk(4): Need pdk->dk_openlock to read pdk->dk_wedges.

dk(4): Make it clearer that dkopen EROFS branch doesn't leak.

It looked like we may need to sometimes call dklastclose in error
branch for the case of (flags & ~sc->sc_mode & FWRITE) != 0, but it
is not actually possible to reach that case: if the caller requested
read/write, and the parent is read-only, and it is the first time
we've opened the parent, then dkfirstopen will fail with EROFS so we
never get there.

But this is confusing and it looked like the error branch is wrong,
so let's rearrange the conditional to make it clearer that we cannot
goto out after dkfirstopen has succeeded. And then assert that the
case cannot happen when we do call dkfirstopen.

dk(4): Fix typo: sc_state, not sc_satte.

Had tested a patch series, but not every patch in it, and I
inadvertently fixed the typo in a later patch in the series, not in
the one I committed.

dk(4): Omit needless sc_iopend, sc_dkdrn mechanism.

vdevgone guarantees that all instances are closed by the time it
returns, which in turn guarantees all I/O operations (read, write,
ioctl, &c.) have completed, and, if the block device is open,
vinvalbuf(V_SAVE) -> vflushbuf has completed, which forces all
buffered transfers to be issued and waits for them to complete.

So by the time vdevgone returns, no further transfers can be
submitted and the bufq must be empty.

ioctl(DIOCRMWEDGES): Delete only idle wedges.

Don't forcibly delete busy wedges.

Reported-by: syzbot+e46f31fe56e04f567d88@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=8a00fd7f2e7459748d7a274098180a4708ff0f61

Fixes accidental destruction of the busy wedge that the root file
system is mounted on, triggered by syzbot's ioctl(DIOCRMWEDGES).

dk(4): dkclose must handle a dying wedge too to close the parent.

Otherwise the parent open leaks on detach (or revoke) when the wedge
was open and had to be forcibly closed.

Reported-by: syzbot+e46f31fe56e04f567d88@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=8a00fd7f2e7459748d7a274098180a4708ff0f61

Fixes assertion sc->sc_dk.dk_openmask == 0.

dk(4): Rename label for consistency. No functional change intended.

dk(4): Fix lock assertion in size increase: parent's, not wedge's.

Reported-by: syzbot+d4dc610473cacc5183dd@syzkaller.appspotmail.com
https://syzkaller.appspot.com/bug?id=e18ddae8283d6fab44cfb1ac7e3f8e791f8c0700

dk(4): Convert tests to assertions in various devsw operations.

.d_cancel, .d_strategy, .d_read, .d_write, .d_ioctl, and .d_discard
are only ever used between successful .d_open return and entry to
.d_close. .d_open doesn't return until sc is nonnull and sc_state is
RUNNING, and dkwedge_detach waits for the last .d_close before
setting sc_state to DEAD. So there is no possibility for sc to be
null or for sc_state to be anything other than RUNNING or DYING.

There is a small functional change here but only in the event of a
race: in the short window between when dkwedge_detach is entered, and
when .d_close runs, any I/O operations (read, write, ioctl, &c.) may
be issued that would have failed with ENXIO before.

This shouldn't matter for anything: disk I/O operations are supposed
to complete reasonably promptly, and these operations _could_ have
begun milliseconds prior, before dkwedge_detach was entered, so it's
not a significant distinction.

Notes:

- .d_open must still contend with trying to open a nonexistent wedge,
of course.

- .d_close must also contend with closing a nonexistent wedge, in
case there were two calls to open in quick succession and the first
failed while the second hadn't yet determined it would fail.

- .d_size and .d_dump are used from ddb without any open/close.

dk(4): Fix racy access to sc->sc_dk.dk_openmask in dkwedge_delall1.

Need sc->sc_parent->dk_rawlock for this, as used in dkopen/dkclose.

dk(4): Narrow the scope of the device numbering lookup on detach.

Just need it for vdevgone, order relative to other things in detach
doesn't matter.

No functional change intended.

dk(4): dkdump: Simplify. No functional change intended.

dk(4): Omit needless locking in dksize, dkdump.

All the members these use are stable after initialization, except for
the wedge size, which dkwedge_size safely reads a snapshot of without
locking in the caller.

dk(4): Take a read-lock on dkwedges_lock if we're only reading.

- dkwedge_find_by_name
- dkwedge_find_by_parent
- dkwedge_print_wnames

dk(4): Set .d_cfdriver and .d_devtounit to plug open/detach race.

This way, opening dkN or rdkN will wait if attach or detach is still
in progress, and vdevgone will wake up such pending opens and make
them fail. So it is no longer possible for a wedge to be detached
after dkopen has already started using it.

For now, we use a custom .d_devtounit function that looks up the
autoconf unit number via the dkwedges array, which conceivably may
use an independent unit numbering system -- nothing guarantees they
match up. (In practice they will mostly match up, but concurrent
wedge creation could lead to different numbering.) Eventually this
should be changed so the two numbering systems match, which would let
us delete the new dkunit function and just use dev_minor_unit like
many other drivers can.

dk(4): Use disk_begindetach and rely on vdevgone to close instances.

The first step is to decide whether we can detach (if forced, yes; if
not forced, only if not already open), and prevent new opens if so.
There's no need to start closing open instances at this point --
we're just making a decision to detach, and preventing new opens by
transitioning state that dkopen will respect[*].

The second step is to force all open instances to close. This is
done by vdevgone. By the time vdevgone returns, there can be no open
instances, so if there _were_ any, closing them via vdevgone will
have passed through dklastclose.

After that point, there can be no opens and no I/O operations, so
dk_openmask must already be zero and the bufq must be empty.

Thus, there's no need to have an explicit call to dklastclose (via
dkwedge_cleanup_parent) before or after making the decision to
detach.

[*] Currently access to this state is racy: nothing serializes
dkwedge_detach's state transition with dkopen's test. TBD in a
separate commit shortly.

dk(4): Fix callout detach race.

1. Set a flag sc_iostop under the lock sc_iolock so dkwedge_detach
and dkstart don't race over it.

2. Decline to schedule the callout if sc_iostop is set. The callout
is already only ever scheduled while the lock is held.

3. Use callout_halt to wait for any concurrent callout to complete.
At this point, it can't reschedule itself.

Without this change, the callout could be concurrently rescheduling
itself as we issue callout_stop, leading to use-after-free later.

dk(4): Add null d_cancel routine to devsw.

This way, dkclose is guaranteed that dkopen, dkread, dkwrite,
dkioctl, &c., have all returned before it runs. For block opens,
setting d_cancel also guarantees that any buffered writes are flushed
with vinvalbuf before dkclose is called.

dk(4): Require dk_openlock in dk_set_geometry.

Not strictly necessary but this makes reasoning easier and documents
with an assertion how disk_set_info is serialized.

dk(4): Assert dkwedges[unit] is the sc we're about to free.

dk(4): Assert parent vp is nonnull before we stash it away.

Let's enable early attribution if this goes wrong.

If it's not the parent's first open, also assert the parent vp is
already nonnull.

dk(4): Don't touch dkwedges or ndkwedges outside dkwedges_lock.

dk(4): Move CFDRIVER_DECL and CFATTACH_DECL3_NEW earlier in file.

Follows the pattern of most drivers, and will be necessary for
referencing dk_cd in dk_bdevsw and dk_cdevsw soon, to prevent
open/detach races.

No functional change intended.

dk(4): Prevent races in access to struct dkwedge_softc::sc_size.

Rules:

1. Only ever increases, never decreases.

(Decreases require removing and readding the wedge.)

2. Increases are serialized by dk_openlock.

3. Reads can happen unlocked in any context where the softc is valid.

Access is gathered into dkwedge_size* subroutines -- don't touch
sc_size outside these. For now, we use rwlock(9) to keep the
reasoning simple. This should be done with atomics on 64-bit
platforms and a seqlock on 32-bit platforms to avoid contention.
However, we can do that in a later change.

dk(4): <sys/rwlock.h> for rwlock(9).

dk(4): KNF: Sort includes.

No functional change intended.

dk(4): ENXIO, not ENODEV, means no such device.

ENXIO is `device not configured', meaning there is no such device.

ENODEV is `operation not supported by device', meaning the device is
there but refuses the operation, like writing to a read-only medium.

Exception: For undefined ioctl commands, it's not ENODEV _or_ ENXIO,
but rather ENOTTY, because why make any of this obvious when you
could make it obscure Unix lore?

dk(4): Fix typo in comment: dkstrategy, not dkstragegy.

No functional change intended.

dk(4): Omit needless void * cast.

No functional change intended.

dk(4): KNF: Whitespace.

No functional change intended.

dk(4): KNF: return (v) -> return v.

No functional change intended.

dk(4): Avoid holding dkwedges_lock while allocating array.

This is not great -- we shouldn't be choosing the unit number here
anyway; we should just let autoconf do it for us -- but it's better
than potentially blocking any dk_openlock or dk_rawlock (which are
sometimes held when waiting for dkwedges_lock) for memory allocation.

dk(4): Restore assertions in dklastclose.

We only enter dklastclose if the wedge is open (sc->sc_dk.dk_openmask
!= 0), which can happen only if dkfirstopen has succeeded, in which
case we hold a dk_rawopens reference to the parent that prevents
anyone else from closing it. Hence sc->sc_parent->dk_rawopens > 0.

On open, sc->sc_parent->dk_rawvp is set to nonnull, and it is only
reset to null on close. Hence if the parent is still open, as it
must be here, sc->sc_parent->dk_rawvp must be nonnull.

dk(4): Explain why dk_rawopens can't overflow and assert it.

branches: 1.124.4;
Remove bogus assertions.

dk(4): Assert about dk_openmask under the lock.

This serves two purposes:

1. Pacifies data race sanitizers.

2. Ensures that we don't spuriously trip over the assertion if
dkclose happens concurrently with dkopen due to a revoke call.

Revert "dk(4): Narrow scope of dk_rawlock on close to dklastclose."

dkfirstopen relies on reading from dk_openmask of _other_ wedges,
writes to dk_openmask must be serialized by dk_rawlock in addition to
dk_openlock. (However, reads from dk_openlock only require one or
the other).

dk(4): dklastclose never fails. Make it return void.

dk(4): Simplify dklastclose.

No functional change intended.

dk(4): Assert parent is open in dklastclose.

It is not possible for us to be closing a wedge whose parent is not
open by at least this wedge.

dk(4): Move first-open logic to new dkfirstopen function.

Makes the logic more clearly pair with dklastclose.

dk(4): Turn locking contract comment into assertions in dklastclose.

dk(4): Narrow scope of dk_rawlock on close to dklastclose.

No need to take it if we're not actually going to close the parent.

No functional change intended; dk_rawlock is only supposed to
serialize dk_rawopens access and open/close of the parent, after all.

dk(4): Factor common mutex_exit out of branches to keep it balanced.

No functional change intended.

dk(4): Move lock release out of dklastclose into caller.

No longer necessary to have this unbalanced logic now that
dk_close_parent correctly happens under the lock in order to
serialize with dk_open_parent.

No functional change intended.

dk(4): Serialize closing parent's dk_rawvp with opening it.

Otherwise, the following events might happen:

- process 123 had /dev/rdkN open, starts close, enters dk_close_parent
- process 456 opens /dev/rdkM (same parent, different wedge), calls
dk_open_parent

At this point, the block device hasn't yet closed, so dk_open_parent
will fail with EBUSY. This is incorrect -- the chardev is never
supposed to fail with EBUSY, and dkopen/dkclose carefully manage
state to avoid opening the block device while it's still open. The
problem is that dkopen in process 456 didn't wait for vn_close
in process 123 to finish before calling VOP_OPEN.

(Note: If it were the _same_ chardev /dev/rdkN in both processes,
then spec_open/close would prevent this. But since it's a
_different_ chardev, spec_open/close assume that concurrency is OK,
and it's the driver's responsibility to serialize access to the
parent disk which, unbeknownst to spec_open/close, is shared between
dkN and dkM.)

It appears that the vn_close call was previously moved outside
dk_rawlock in 2010 to work around an unrelated bug in raidframe that
had already been fixed in HEAD:

Crash pointing to dk_rawlock and raidclose:
https://mail-index.netbsd.org/tech-kern/2010/07/27/msg008612.html

Change working around that crash:
https://mail-index.netbsd.org/source-changes/2010/08/04/msg012270.html

Change removing raidclose -> mutex_destroy(&dk_rawlock) path:
https://mail-index.netbsd.org/source-changes/2009/07/23/msg223381.html

Since rev 1.101 DIOCAWEDGE could return success without filling in the
wedge device name - which is quite confusing for userland.
Always fill the name if we return success.

Need vnode locked fot VOP_FDISCARD().

dk(4): Omit redundant microoptimization around cv_broadcast.

cv_broadcast already has a fast path for the no-waiter case.

Whitespace nits.

Remove funny straggling blank line.

fix some more typos in comments/log messages, improve wording as well.

Swap and Dump uses DEV_BSIZE units. Translate from device sectors like
regular I/O (strategy).

Clear sc_mode only on last close.

Copy mode of open wedges with the same parent and validate it.
Remove race on mode value when closing.

branches: 1.103.2;
Handle read-only parent devices.

Currently this only affects xbd(4). Other disk drivers succeed opening
read-only disks as read-write and only fail subsequent write requests.

branches: 1.102.6; 1.102.8;
Check dkdriver before calling a driver function.

dkwedge_add: Allow for expanding the size of an existing wedge without
having to delete it first, provided that no other parameters have changed.

New ioctl DIOCGSECTORALIGN returns sector alignment parameters.

struct disk_sectoralign {
/* First aligned sector number. */
uint32_t dsa_firstaligned;

/* Number of sectors per aligned unit. */
uint32_t dsa_alignment;
};

- Teach wd(4) to get it from ATA.
- Teach cgd(4) to pass it through from the underlying disk.
- Teach dk(4) to pass it through with adjustments.
- Teach zpool (zfs) to take advantage of it.
=> XXX zpool doesn't seem to understand when the vdev's starting
sector is misaligned.

Missing:

- ccd(4) and raidframe(4) support -- these should support _using_
DIOCGSECTORALIGN to decide where to start putting ccd or raid
stripes on disk, and these should perhaps _implement_
DIOCGSECTORALIGN by reporting the stripe/interleave factor.

- sd(4) support -- I don't know any obvious way to get it from SCSI,
but if any SCSI wizards know better than I, please feel free to
teach sd(4) about it!

- any ld(4) attachments -- might be worth teaching the ld drivers for
nvme and various raid controllers to get the aligned sector size

There's some duplicate logic here for now. I'm doing it this way,
rather than gathering the logic into a new disklabel_sectoralign
function or something, so that this change is limited to adding a new
ioctl, without any new kernel symbols, in order to make it easy to
pull up to netbsd-9 without worrying about the module ABI.

Allow dumping to cgd(4) on a dk(4).

(Technically this also allows dumping to a dk(4) on which there
happens to be a cgd(4) configured, but I'm not sure how to
distinguish that case here. So don't do that!)

Update sc->sc_parent->dk_rawvp while the lock named dk_rawlock held
to prevent a race condition

Fixes PR kern/55026

OKed by mlelstv@, thanks

branches: 1.97.2; 1.97.8; 1.97.10;
Support dump on wedges.

branches: 1.96.4; 1.96.6; 1.96.12;
Enhance disk metrics by calculating a weighted sum that is incremented
by the number of concurrent I/O requests. Also introduce a new disk_wait()
function to measure requests waiting in a bufq.
iostat -y now reports data about waiting and active requests.

So far only drivers using dksubr and dk, ccd, wd and xbd collect data about
waiting requests.

pass also DIOCGCACHE to underlying device, so that upper layers would be able
to get the device cache properties without knowing the topology; while here also
pass down DIOCGSTRATEGY for neater dkctl(8) output

use a bounded copy. NFCI

branches: 1.93.2;
add missing mutex/cv cleanup to error paths.

Make dk(4) device mpsafe.

branches: 1.91.2;
missed one exit path with the previous change.

release openlock mutex before closing parent device.

Add dkwedge_find_by_parent()

Allow dump to raidframe component which is a wedge.

N.B. ordinary devices check the partition type only in the xxxsize routine.

Return error in dkopen when dk_open_parent fails. Also change dk_open_parent
to pass error code to caller.
XXX: Pullups

sc_size is already measured in sectors.

remove incorrect comment (from kre)

print wedge announcement in one line instead of two

Rename variable to avoid -Wshadow warnings with some compilers.

No longer access the disk driver directly.
If there is an open wedge, temporarily reference its vnode.
Otherwise try to open the block device.

revert the previous

when scanning for disklabels, close block device only when this was
the first open. The device driver doesn't do reference counting.

This is still subject to race conditions.

- Use NODEV instead of 0
- Return EBUSY if there was no label

make more drivers use disk_ioctl, and add a dev parameter to it so that
we can merge the "easy" disklabel ioctls to it. Ultimately all this will
go do dk_ioctl once all the drivers have been converted.

disk_blocksize and disk_set_info relay the same information
to the disk subsystem.

Make disk_set_info also set blocksize shift values.
Remove every call to disk_blocksize.

Keep disk_blocksize for ABI compatibility, make it also set dg_secsize.

Really provide disk properties, the old code computed values that were
never attached to the device.

branches: 1.75.2;
fix iobuf setup, cleanup

Implement DIOCMWEDGES ioctl that triggers wedge autodiscovery.
Also fix a reference counting bug and clean up some code.

Make dk(4) discard from partition start, not from disk start.

Otherwise, anything mounted with `-o discard' will pretty quickly
munch itself up and barf up an unrecoverably corrupted file system!

XXX pullup to netbsd-7

branches: 1.72.2;
Implement d_discard for dk. This closes PR 47940.

Add d_discard to all struct cdevsw instances I could find.

All have been set to "nodiscard"; some should get a real implementation.

Add d_discard to all struct bdevsw instances I could find.

I've set them all to nodiscard. Some of them (wd, dk, vnd, ld,
raidframe, maybe cgd) should be implemented for real.

branches: 1.69.2;
add dkwedge_get_parent_name().

Change (mostly mechanically) every cdevsw/bdevsw I can find to use
designated initializers.

I have not built every extant kernel so I have probably broken at
least one build; however I've also found and fixed some wrong
cdevsw/bdevsw entries so even if so I think we come out ahead.

Don't complain about not being able to open empty removable media drives.

branches: 1.66.2;
phase 1 of disk geometry cleanup:
- centralize the geometry -> plist code so that we don't have
n useless copies of it.

split device_t/softc for all remaining drivers.
replace "struct device *" with "device_t".
use device_xname(), device_unit(), etc.

branches: 1.64.2;
Make detection of root on wedges (dk(4)) machine independent. Remove
MD code for x86, xen, sparc64.

minor mostly cosmetical fixes: use designated type for device major
numbers, typo in comment, misuse of minor()
(the latter one is not cosmetical, but would only affect systems
with more than 256 disk wedges)

branches: 1.62.2; 1.62.6; 1.62.8;
Add an FSILENT flag and use it to suppress "Medium Not Present" scsipi
spam when trying to access offline drives at boot.

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.60.2;
check rawvp before doing ioctl or strategy.

Make error checking consistent, possibly fixes PR/44652.

branches: 1.58.2; 1.58.4;
Make wedges aware of underlying physical block size.

Make sure to release sc_parent->dk_rawlock before calling
vn_close(sc->sc_parent->dk_rawvp). Avoids a lockdebug panic:
error: mutex_destroy: assertion failed: !MUTEX_OWNED(mtx->mtx_owner) && !MUTEX_HAS_WAITERS(mtx)
when the parent is a raidframe device.
See also:
http://mail-index.netbsd.org/tech-kern/2010/07/27/msg008612.html

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

branches: 1.55.2; 1.55.4;
d_psize routine returns a number of blocks or -1 on error.
d_dump routine returns 0 or an error code.

GPTs are defined in terms of physical blocks.
- Fix reading of GPT for devices with non-512byte sectors
- Fix bounds check to use DEV_BSIZE units.

struct buf::b_iodone is not called at splbio() any more.
Make sure non-MPsafe iodone callbacks raise the SPL as appropriate.
Fix buffer corruption issue I noticed in dk(4), and probable similar
issues in vnd(4) and cgd(4).

Implement and use a dkminphys() that calls the parent device's minphys
function with b_dev temporarily adjusted to the parent device's dev_t.

Fixes PR/37390.

dkwedge_list() is currently called only from ioctl routines where
l == curlwp. Since there is no perceived case where we'd ever want
to copy the list to non-curlwp, simplify the code a bit.
(the struct lwp * argument could probably be dropped too, but
that's another commit)

grow some _KERNEL_POT

Remove autoconf dependency on vfs and dk:
opendisk() -> kern/subr_disk_open.c
config_handle_wedges -> dev/dkwedge/dk.c

Add support for DIOCGDISKINFO for wedges. This fixes regression after my
DIOCGDISKINFO commit to fsck/partutil.c.

Tested by me and adegroot@.

Extract a lot of code from dkwedge_del(), and move it to dkwedge_detach()
to create a comprehensive detachment hook. Let that hook run at
shutdown. Now, 'drvctl -d dk0' actually deletes a wedge if it is
not in-use (otherwise fails w/ EBUSY), and wedges are gracefully
detached from their "parent" at shutdown.

Extract subroutine dklastclose(). This is a step toward detachable
dk(4).

struct device * -> device_t, no functional changes intended.

struct cfdata * -> cfdata_t, no functional changes intended.

branches: 1.43.2;
g/c BUFQ_FOO() macros and use bufq_foo() directly.

branches: 1.42.4; 1.42.6; 1.42.10; 1.42.12;
Mark a buffer `busy` in getnewbuf() when it came from the pool_cache since
its not on a free list.

Also change buf_init() to not automatically mark buffers `busy' since this
only makes sense for bufcache buffers.

Mark all buf_init'd buffers 'busy' on the places where they ought to be
flagged as such to not confuse the buffer cache.

Fixes PR 38923.

branches: 1.41.2;
dkwedge_read: don't place struct buf on the stack.

Call buf_destroy when finished with an on-stack struct buf.

Spotted by LOCKDEBUG, because the condvars were already initialised.

branches: 1.39.2;
after the "struct disk" is finished with, it should be
destroyed with disk_destroy(9) to stave off LOCKDEBUG
panics.

Remove clause 3 and 4 from TNF licenses

branches: 1.37.2; 1.37.4;
Fix a minor nit in a comment

use aprint_*_dev and device_xname

Catch up with descriptor handling changes. See kern_descrip.c revision
1.173 for details.

Split device_t/softc. Well, there's not much to split there, as the
device_t didn't contain the softc anyway.

This driver should be re-structured so it doesn't have to manage its own
set of softcs.

branches: 1.33.2; 1.33.6;
Hold v_interlock when adjust v_writecount.

Merge vmlocking2 to head.

branches: 1.31.2;
Merge jmcneill-pm branch.

branches: 1.30.2; 1.30.4;
Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

branches: 1.29.4;
Merge disk init changes from the vmlocking branch. These seperate init /
destroy of 'struct disk' from attach / detach.

branches: 1.28.4; 1.28.6; 1.28.8; 1.28.10;
It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.

Replace some uses of lockmgr().

branches: 1.26.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Extract common code from i386, xen, and sparc64, creating
config_handle_wedges() and read_disk_sectors(). On x86, handle_wedges()
is a thin wrapper for config_handle_wedges(). Share opendisk()
across architectures.

Add kernel code in support of specifying a root partition by wedge
name. E.g., root specifications "wedge:wd0a", "wedge:David's Root
Volume" are possible. (Patches for config(1) coming soon.)

In support of moving disks between architectures (esp. i386 <->
evbmips), I've written a routine convertdisklabel() that ensures
that the raw partition is at RAW_DISK by following these steps:

0 If we have read a disklabel that has a RAW_PART with
p_offset == 0 and p_size != 0, then use that raw partition.

1 If we have read a disklabel that has both partitions 'c'
and 'd', and RAW_PART has p_offset != 0 or p_size == 0,
but the other partition is suitable for a raw partition
(p_offset == 0, p_size != 0), then swap the two partitions
and use the new raw partition.

2 If the architecture's raw partition is 'd', and if there
is no partition 'd', but there is a partition 'c' that
is suitable for a raw partition, then copy partition 'c'
to partition 'd'.

3 Determine the drive's last sector, using either the
d_secperunit the drive reported, or by guessing (0x1fffffff).
If we cannot read the drive's last sector, then fail.

4 If we have read a disklabel that has no partition slot
RAW_PART, then create a partition RAW_PART. Make it span
the whole drive.

5 If there are fewer than MAXPARTITIONS partitions,
then "slide" the unsuitable raw partition RAW_PART, and
subsequent partitions, into partition slots RAW_PART+1
and subsequent slots. Create a raw partition at RAW_PART.
Make it span the whole drive.

The convertdisklabel() procedure can probably stand to be simplified,
but it ought to deal with all but an extraordinarily broken disklabel,
now.

i386: compiled and tested, sparc64: compiled, evbmips: compiled.

Unwedge the previous change. Always increment the number of rawopens if the
open is successful.

Fix two bugs:

1 In dkopen(), do not leave dk_rawopens > 0 if the open ultimately
failed for some reason.

2 Add a dkdump() implementation by Martin Husemann for writing
system dumps to wedges. Tiny modifications by me. Lightly tested
on an evbmips box.

branches: 1.22.2; 1.22.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.21.2;
dkwedge_discover: open a device as read-only.

__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.18.2;
Typo in comment.

branches: 1.17.2;
avoid diagnostic panic if both blk and chr wedge are open at the same time

- Use the LWP cached credentials where sane.
- Minor cosmetic changes.

integrate kauth.

A couple of fixes from dbj@:
- dkwedge_del(): Don't compute a minor number based on partitions, because
wedges don't have partitions. Just provide the unit number to vdevgone().
- dkopen(): Make sure we release all of the locks we've acquired should
opening the parent device fail.

Implement dksize().

branches: 1.12.2; 1.12.4; 1.12.6;
merge yamt-uio_vmspace branch.

- use vmspace rather than proc or lwp where appropriate.
the latter is more natural to specify an address space.
(and less likely to be abused for random purposes.)
- fix a swdmover race.

branches: 1.11.2; 1.11.4;
- add simple functions to allocate/free a buffer for i/o.
- make bufpool static.

branches: 1.10.2;
merge ktrace-lwp.

- change the way to specify a bufq strategy. (by string rather than by number)
- rather than embedding bufq_state in driver softc,
have a pointer to the former.
- move bufq related functions from kern/subr_disk.c to kern/subr_bufq.c.
- rename method to strategy for consistency.
- move some definitions which don't need to be exposed to the rest of kernel
from sys/bufq.h to sys/bufq_impl.h.
(is it better to move it to kern/ or somewhere?)
- fix some obvious breakage in dev/qbus/ts.c. (not tested)

Set sc->sc_cfdata.cf_fstate to FSTATE_STAR rather than FSTATE_NOTFOUND
so that config_detach() doesn't panic.

(XXX this points to some disagreement between config_attach_pseudo()
and config_detach() over the correct role of pseudo-device cfdata)

branches: 1.7.2;
avoid variable shadowing.

nuke trailing whitespace

branches: 1.5.4; 1.5.6;
move buffer queue related stuffs from buf.h to their own header, bufq.h.

Implement the DIOCCACHESYNC ioctl; we just pass it along to the parent.

- Adjust minor number usage for wedges; minor number directly maps to
unit now. Don't pretend wedges have "partitions".
- Fix a buglet related to opening char and block devices of a wedge
at the same time.
- Add dkwedge_set_bootwedge(), that MD code can call to set booted_device
and booted_wedge appropriately when MD code knows the parent disk and
the start/size of the wedge that was booted from.

branches: 1.2.2;
Use config_attach_pseudo() to create device instances in the device
tree for created wedges. This is necessary for setroot().

Move wedge code to a subdirectory, as suggested by Christos.

allocate buffer for disk I/O via geteblk() instead of malloc(), so they
are properly aligned; e.g. readdisklabel() does the same

also removed the DKW_MALLOC()/DKW_FREE()/DKW_REALLOC() macros as apparently
unnecessary, these files don't seem to be compiled into any userland tools

dkwedge_gpt.c confirmed working, others compile-tested only

branches: 1.5.8;
Fix info leak: always clear 'dkw', because some of its (otherwise
uninitialized) fields can be copied to userland, typically in the
DIOCGWEDGEINFO ioctl.

Add a condition in the loop. Otherwise there could be an infinite loop,
and we could also be wrongfully adding more wedges than necessary.
Arbitrarily limit the number of blocks to 512, like GPT.

branches: 1.3.14;
use a bounded copy. NFCI

branches: 1.2.2; 1.2.4;
Look at the bzb flags to mark partition as swap. Requested by John D. Baker.
XXX: Pullup-7

branches: 1.1.2; 1.1.4; 1.1.6; 1.1.18; 1.1.20;
recognize apple disks.

allocate buffer for disk I/O via geteblk() instead of malloc(), so they
are properly aligned; e.g. readdisklabel() does the same

also removed the DKW_MALLOC()/DKW_FREE()/DKW_REALLOC() macros as apparently
unnecessary, these files don't seem to be compiled into any userland tools

dkwedge_gpt.c confirmed working, others compile-tested only

branches: 1.24.8;
Fix info leak: always clear 'dkw', because some of its (otherwise
uninitialized) fields can be copied to userland, typically in the
DIOCGWEDGEINFO ioctl.

branches: 1.23.20;
Handle disks with non DEV_BSIZE sectors.

When converting a disklabel partition type integer to a wedge partition
type string, use the strings defined in DKW_PTYPE_* in <sys/disk.h>, not
the strings defined in FSTYPE_DEFN in <sys/disklabel.h>.

This corrects a problem introduced in revision 1.21 dated 2014-08-18.
That change was intended to add additional case to the list, but it
accidentally also changed from the strings in the DKW_PTYPE_* macros to
the strings in the FSTYPE_DEFN macro. Many of the strings are the same,
but there are differences such as "RAID" versus "raidframe" and "MSDOS"
versus "FAT".

XXX: There seems to be no good reason for the differences in string
names for partition types. One or both of the lists should probably be
edited to align them.

Use FSTYPE_DEFN from <sys/disklabel.h> to generate case branches for
conversions from all known disklabel fstypes to strings. This replaces
the hand-coded list of conversions for only a few of the known types.

Don't ignore unrecognised partition types in BSD disklabels;
instead, add them with wedge partition type "unknown#%u", where
%u is the underlying numeric partition type from the BSD disklabel.

branches: 1.19.4;
Bring back the playstation2 port - now that a toolchain for it is
available again.

Rename NetBSD/hp700 to NetBSD/hppa.

Unfortunately our VCS isn't very helpful here.

branches: 1.17.2; 1.17.4;
Use the label's packname to create wedge names instead of the classic
device names. Fall back to classic device names when the label has an
empty name or the default name 'fictitious'.

branches: 1.16.12; 1.16.18;
Remove support for NetBSD/playstation2.

Remove clause 3 and 4 from TNF licenses

branches: 1.14.28; 1.14.30; 1.14.32;
Reduce code duplication in validate_label(). Extract some lengthy
code to give it 8 more columns of horizontal space, creating
addwedges() in this way.

Remove support for NetBSD/{,evb}sh5.

branches: 1.12.2; 1.12.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

Make this compilable from userland

Split the disklabel checksum function into two, so we can pass the
length separately.
Use this for foreign-endianess labels in wedge autodiscovery, and
calculate the checksum of those before we swap various fields in the
label.

branches: 1.9.2; 1.9.4; 1.9.8;
__unused removal on arguments; approved by core.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.7.2; 1.7.4;
Backout previous - it is already dealt with at the config level.

Make the discovery methods optional (as they were already declared
in conf/files)

As core requested, remove vinum

branches: 1.4.2; 1.4.4; 1.4.6;
merge ktrace-lwp.

branches: 1.3.4;
nuke trailing whitespace

branches: 1.2.4; 1.2.6;
Check d_magic2 once, and not d_magic twice. Pointed out by tsarna.

branches: 1.1.2;
Add a parsing module for 4.4BSD/NetBSD disklabels. This module supports
disklabels nested inside an MBR "NetBSD" or "386BSD" partition (first
one found is considered authoritative for the disk), or in one of several
known locations for various NetBSD platforms. It can read native or other-
endian disklabels (code is there, but not tested).

If you want to play with this, exercise caution; you can't currently
mountroot on a wedge (setroot() needs some work). Enabled by the
DKWEDGE_METHOD_BSDLABEL kernel option.

allocate buffer for disk I/O via geteblk() instead of malloc(), so they
are properly aligned; e.g. readdisklabel() does the same

also removed the DKW_MALLOC()/DKW_FREE()/DKW_REALLOC() macros as apparently
unnecessary, these files don't seem to be compiled into any userland tools

dkwedge_gpt.c confirmed working, others compile-tested only

branches: 1.25.2;
Teach dk(4) about ZFS.

"looks ok" mlelstv

Fix info leak: always clear 'dkw', because some of its (otherwise
uninitialized) fields can be copied to userland, typically in the
DIOCGWEDGEINFO ioctl.

Fix buffer overflow. Triggerable by plugging a specially-crafted USB key
in the machine (the kernel automatically tries to parse its GPT header).
The check could maybe be appeased to allow bigger sizes, but we've never
done that, so I'm leaving it as-is.

add types for windows and linux partitions.

add support to detect the 3 vmware GPT partition types:

- VMKcore (dump partition)
- VMFS
- VMware reserved

this enables vmkcore partitions for netbsd swap or dump, as well
as naming all of them.

branches: 1.20.2; 1.20.4;
use arraycount.

PR/52522: ent_name is not necessarily 0 terminated, so check bounds.
XXX: pullup-8

branches: 1.18.6;
use a bounded copy. NFCI

branches: 1.17.2; 1.17.4;
Fix tyop

Fix error message.

Quadruple GPT partition entry count limit (to 512 entries or 64KiB).

The UEFI 2.3.1 specification states that:
"A minimum of 16,384 bytes of space must be reserved for the GPT Partition Entry Array."
and [the size of a partition entry shall be a power of two greater than 128]
and that [the defined fields of a partition entry total 128 bytes].

Clamping the entries means that no partitions on the drive will be detected,
as this will result in an incorrect partition entry array CRC. This change
reduces the likelyhood of useless partitions, while still not allowing a
huge kernel memory allocation to load the partition entries into.

In the future this code should probably be reworked to checksum and evaluate
the partition array in chunks while still limiting the number of GPT
wedges added per drive to something reasonable.

branches: 1.14.2;
Be less noisy when handling wedge name conflicts.

src is too big these days to tolerate superfluous apostrophes. It's
"its", people!

branches: 1.12.18; 1.12.34;
Use wput_utf8() to improve conversion of UTF-16 GPT partition names to UTF-8.
Drop static CRC32 function in favor of the one from libkern.

branches: 1.11.2; 1.11.4;
GPTs are defined in terms of physical blocks.
- Fix reading of GPT for devices with non-512byte sectors
- Fix bounds check to use DEV_BSIZE units.

Allow wedges to be created for all defined partitions on a GPT disk.
Use __arraycount on the GUID to type mapping array.
Add HFS to the list of types with dkw_ptypes.

reviewed by cube.

branches: 1.9.2;
Recognize apple ufs partitions from Antoine Reilles

branches: 1.8.2; 1.8.4;
Remove clause 3 and 4 from TNF licenses

branches: 1.7.6; 1.7.8; 1.7.10;
As discussed on tech-userlevel, add NetBSD GPT partition types for
swap, ffs, lfs, raidframe, ccd and cgd. gpt(8) now defaults to
NetBSD ffs if no type is given, but previous FreeBSD types are
still recognized in the DKWEDGE_AUTODISCOVER code.

branches: 1.6.16; 1.6.22; 1.6.28;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.5.4; 1.5.6; 1.5.10;
use a c99 initializer

branches: 1.4.2;
Backout previous - it is already dealt with at the config level.

Make the discovery methods optional (as they were already declared
in conf/files)

branches: 1.2.4; 1.2.8;
merge ktrace-lwp.

branches: 1.1.2; 1.1.14;
Move wedge code to a subdirectory, as suggested by Christos.

In case of trouble reading an MBR, make sure error field is set before reporting it

branches: 1.12.20;
allocate buffer for disk I/O via geteblk() instead of malloc(), so they
are properly aligned; e.g. readdisklabel() does the same

also removed the DKW_MALLOC()/DKW_FREE()/DKW_REALLOC() macros as apparently
unnecessary, these files don't seem to be compiled into any userland tools

dkwedge_gpt.c confirmed working, others compile-tested only

branches: 1.11.8;
Fix info leak: always clear 'dkw', because some of its (otherwise
uninitialized) fields can be copied to userland, typically in the
DIOCGWEDGEINFO ioctl.

branches: 1.10.14;
use a bounded copy. NFCI

branches: 1.9.2; 1.9.4;
Skip protective MBR early too.

branches: 1.8.2;
get sector size from disk structure.

branches: 1.7.2; 1.7.14;
use the partition sector size.

branches: 1.6.34; 1.6.38;
Remove clause 3 and 4 from TNF licenses

branches: 1.5.52; 1.5.54; 1.5.56;
Backout previous - it is already dealt with at the config level.

Make the discovery methods optional (as they were already declared
in conf/files)

branches: 1.3.4;
merge ktrace-lwp.

Make this compile again.

branches: 1.1.2;
MBR partition table support for wedges, enabled by the DKWEDGE_METHOD_MBR
option.

Misc style fixes. No binary changes.

- Use uint{32,8}_t instead of unsigned {int, char}.
- Sort headers.
- KNF

branches: 1.7.2;
Fix fallout of migration from malloc to geteblk.

- Use bp->b_data instead of bp itself.
- When buffer is not large enough, start all over; brelse + geteblk does not
apparently behave like realloc.

allocate buffer for disk I/O via geteblk() instead of malloc(), so they
are properly aligned; e.g. readdisklabel() does the same

also removed the DKW_MALLOC()/DKW_FREE()/DKW_REALLOC() macros as apparently
unnecessary, these files don't seem to be compiled into any userland tools

dkwedge_gpt.c confirmed working, others compile-tested only

branches: 1.5.8;
Fix info leak: always clear 'dkw', because some of its (otherwise
uninitialized) fields can be copied to userland, typically in the
DIOCGWEDGEINFO ioctl.

branches: 1.4.2; 1.4.6; 1.4.14; 1.4.18; 1.4.22;
remove unnecessary substitution. no functional changes.

determine the buffer size by roundup(9)

Remove PARANOID macro; we should always update secsize if necessary.

Add DKWEDGE_METHOD_RDB option, which is Amiga Rigid Disk Block (RDB)
partitioning detection method for dk(4).

Use "%zu" for type "size_t". Kernel ALL/i386 compiles again.

dk(4): Add support for discovering Atari TOS partitions as wedges

Any partitioning scheme which conforms to the Atari AHDI 3.00 spec should be
recognized by the new DKWEDGE_METHOD_TOS.