branches: 1.1.2; 1.1.6; 1.1.8;
kernel portion of puffs - the Pass-to-Userspace Framework File System.
It contains the VFS attachment and userspace message-passing interface.

This work was initially started and completed for Google SoC 2005
and tweaked to work a bit better in the past few weeks. While
being far from complete, it is functional enough to be able and
stable to host a fairly general-purpose in-memory file system in
userspace. Even so, puffs should be considered experimental and
no binary compatibility for interfaces or crash-freedom or zero
security implications should be relied upon just yet.

The GSoC project was mentored by William Studenmund and the final
review for the code was done by Christos.

branches: 1.1.2;
add some todo-items, based on a file which was lingering in my
local tree for apparently almost two years now

It turns out we do want the puffs compat code in any kernel which
has built-in compat_50 regardless of whether the kernel also has
puffs.

Should finally fix PR kern/53943

try '&' instead of '&&'

Don't include puffs_compat in a kernel unless the filesystem is
selected along with COMPAT_50. Also, don't include puffs_compat
in the main puffs filesystem module; it is part of the compat_50
module.

Should address PR kern/53943

Merge the [pgoyette-compat] branch

branches: 1.6.18; 1.6.20;
Define filesystem attributes with vfs dependency.

branches: 1.5.18;
remember to add the new file to the build

branches: 1.4.18; 1.4.38; 1.4.40;
Part 2/n of extensive changes to request transport to/from userspace:

Rip the transport code completely out of puffs and generalize it
into an independent module which will be used for multiple purposes
in the future. This module is called the Pass-to-Userspace
Transporter (known as "putter" among friends).

This is very much work-in-progress and one dependency with puffs
remains: the request framing format.

The device name is still /dev/puffs, but that will change soon.

Users of puffs need the following in their kernel configs now:
pseudo-device putter

branches: 1.3.2; 1.3.4;
Split routines handling nodes from puffs_subr to puffs_node.
No functional change.

branches: 1.2.2; 1.2.4; 1.2.10; 1.2.22; 1.2.24; 1.2.26;
shuffle functions around a bit: move the transport (/dev/puffs) to
a different file from the messaging (request contents). no functional
change

branches: 1.1.2;
kernel portion of puffs - the Pass-to-Userspace Framework File System.
It contains the VFS attachment and userspace message-passing interface.

This work was initially started and completed for Google SoC 2005
and tweaked to work a bit better in the past few weeks. While
being far from complete, it is functional enough to be able and
stable to host a fairly general-purpose in-memory file system in
userspace. Even so, puffs should be considered experimental and
no binary compatibility for interfaces or crash-freedom or zero
security implications should be relied upon just yet.

The GSoC project was mentored by William Studenmund and the final
review for the code was done by Christos.

Rather than keeping a separate mutex, condvar, and pserialize for each
module hook, we can share a common set of synchronization structures.
This cuts the amount of cacheline_aligned data for these structures by
50%.

Note that we still have a per-hook localcount, since we need to count
individual references.

As discussed with riastradh@

Welcome to 9.99.22 !

Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Normalize all the compat hooks' names to the form

<subsystem>_<function>_<version>_hook

NFCI

XXX Note that although this introduces a change in the kernel-to-
XXX module interface, we are NOT bumping the kernel version number.
XXX We will bump the version number once the interface stabilizes.

Merge the [pgoyette-compat] branch

branches: 1.4.16; 1.4.18;
sprinkle COMPAT_50

branches: 1.3.2;
Do not uselessly include <sys/malloc.h>.

branches: 1.2.2; 1.2.4; 1.2.10; 1.2.24; 1.2.40;
Do fhtovp compat translation only for fhtovp ops, not all vfs ops.
Allocate tailing extra buffer for compat op too.

Add compat to enable running puffs in a 64bit time_t kernel against
a server which runs in 32bit time_t namespace.

s/furher/further/ in comment.

branches: 1.107.2;
fix spelling mistakes, mainly in comments and log messages.

hardclock_ticks -> getticks()

UVM locking changes, proposed on tech-kern:

- Change the lock on uvm_object, vm_amap and vm_anon to be a RW lock.
- Break v_interlock and vmobjlock apart. v_interlock remains a mutex.
- Do partial PV list locking in the x86 pmap. Others to follow later.

branches: 1.104.6;
Rename the MODULE_*_HOOK() macros to MODULE_HOOK_*() as briefly
discussed on irc.

NFCI intended.

Ride the earlier kernel bump - it;s getting crowded.

Normalize all the compat hooks' names to the form

<subsystem>_<function>_<version>_hook

NFCI

XXX Note that although this introduces a change in the kernel-to-
XXX module interface, we are NOT bumping the kernel version number.
XXX We will bump the version number once the interface stabilizes.

Merge the [pgoyette-compat] branch

branches: 1.101.10; 1.101.12;
Add vfs_ref(mp) and vfs_rele(mp) to add or remove a reference to
struct mount. Rename vfs_destroy(mp) to vfs_rele(mp) and replace
incrementing mp->mnt_refcnt with vfs_ref(mp).

branches: 1.100.2;
Hold the interlock when calling cv_broadcast as per condvar(9)

branches: 1.99.2;
KNF. Remove extra spaces. No functional change.

Remove miscfs/syncfs and

- move the syncer into kern/vfs_subr.c.

- change the syncer to process the mountlist and VFS_SYNC as appropriate.

- use an API for mount points similiar to the API for vnodes:
- vfs_syncer_add_to_worklist(struct mount *mp) to add
- vfs_syncer_remove_from_worklist(struct mount *mp) to remove a mount.

No objections on tech-kern@

branches: 1.97.2;
Do not uselessly include <sys/malloc.h>.

Don't use C++ class and this keywords as variables.

Change puffs from hashlist to vcache.
- field "pa_nhashbuckets" of struct "puffs_kargs" becomes a no-op.
and should be removed on the next protocol version bump.

branches: 1.94.4;
- remove unused variables
- add _NOERROR flavor macros for the case where errors are ignored.

branches: 1.93.2;
Excise struct componentname from the namecache.

This uglifies the interface, because several operations need to be
passed the namei flags and cache_lookup also needs for the time being
to be passed cnp->cn_nameiop. Nonetheless, it's a net benefit.

The glop should be able to go away eventually but requires structural
cleanup elsewhere first.

This change requires a kernel bump.

branches: 1.92.2;
Rename slow sopreq queue into node sopreq queue, to refet the fact that
is only intended for postponed node reclaims.
When purging the node sopreq queue, do not call puffs_msg_sendresp(), as
it makes no sense.

Fix hang unmount bug introduced by last commit.

We introduced a slow queue for delayed reclaims, while the existing
queue for unmount, flush and exist has been renamed fast queue. Both
queues had timestamp for when an operation should be done, but it was
useless for the fast queue, which is always used to run an operation
ASAP. And the timestamp test had an error that turned ASAP into "at next
tick", but nobody what there to wake the thread at next tick, hence
the hang. The fix is to remove the useless and buggy timestamp test for
fast queue.

- Improve PUFFS_KFLAG_CACHE_FS_TTL by reclaiming older inactive nodes.

The normal kernel behavior is to retain inactive nodes in the freelist
until it runs out of vnodes. This has some merit for local filesystems,
where the cost of an allocation is about the same as the cost of a
lookup. But that situation is not true for distributed filesystems.
On the other hand, keeping inactive nodes for a long time hold memory
in the file server process, and when the kernel runs out of vnodes, it
produce reclaim avalanches that increase lattency for other operations.

We do not reclaim inactive vnodes immediatly either, as they may be
looked up again shortly. Instead we introduce a grace time and we
reclaim nodes that have been inactive beyond the grace time.

- Fix lookup/reclaim race condition.

The above improvement undercovered a race condition between lookup and
reclaim. If we reclaimed a vnode associated with a userland cookie while
a lookup returning that same cookiewas inprogress, then the kernel ends
up with a vnode associated with a cookie that has been reclaimed in
userland. Next operation on the cookie will crash (or at least confuse)
the filesystem.

We fix this by introducing a lookup count in kernel and userland. On
reclaim, the kernel sends the count, which enable userland to detect
situation where it initiated a lookup that is not completed in kernel.
In such a situation, the reclaim must be ignored, as the node is about
to be looked up again.

branches: 1.89.2; 1.89.8;
Remove #ifdef DIAGNOSTIC guards around KASSERT, as the macro contains them

Make sure pagedaemon does not sleep for memory in puffs_vnop_sleep.
Add KASSERT on any sleeping memory allocation to check it cannot happen again.

avoid some uninitialised variable warnings from GCC.
at least the puffs one seems valid, but i'm not 100% sure.

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.85.2;
puffs_msg_wait: check PARKFLAG_HASERROR before PARKFLAG_CALL. PR/44240.

branches: 1.84.2; 1.84.4;
Apply patch from PR kern/44093 by yamt:

Interrupt server wait only on certain signals (same set at nfs -i)
instead of all signals. According to the PR this helps with
"git clone" run on a puffs file system.

Allow clients to reuse a "park".

Patch from <yamt>, fixes PR kern/44086 by him.

Remove groolingly spooky variable which has been haunting us for
several years without doing anything useful.

Add compat to enable running puffs in a 64bit time_t kernel against
a server which runs in 32bit time_t namespace.

branches: 1.80.2; 1.80.4;
In case the operations thread has exited, do not queue any more
operations. This prevents kernel memory leaks (one of which happened
every time the file system was unmounted via PUFFSOP_UNMOUNT ...
and incidentally would've been trivially caught with the old
malloc(9) interface. I wonder if the message is to use a ton of
pools instead of regression-attractive kmem interface).

Rename PUFFS_SOPREQ_EXIT to PUFFS_SOPREQSYS_EXIT to better signal
it comes from within the kernel instead of as a direct result of
a user request.

no functional change

Fix variable name in my commit tree too.

Add a PUFFS_UNMOUNT server->kernel request, which causes the kernel
to initiate self destruct, i.e. unmount(MNT_FORCE). This, however,
is a semi-controlled self-destruct, since all caches are flushed
before the (possibly) violent unmount takes place.

Process flush requests from the file server in a separate thread
context. This fixes a long-standing but seldomly seen deadlock,
where the kernel was holding pages busy (due to e.g. readahead
request) while waiting for the server to respond, and the server
made a callback into the kernel asking to invalidate those pages.
... or, well, theoretically fixes, since I didn't have any reliable
way of repeating the deadlock and I think I saw it only twice.

Need to send protocol layer response instead of transport layer
return value. While there, just collapse all non-supported types
into one entry.

Kill suspend support. It was never implemented correctly:
* it depended on the biglock (in a very cruel way)
* it was attached to userspace transactions rather than logical
fs operations

(If someone wants to revisit it some day, most of the stuff can be
reused from cvs history)

Ansify function definitions w/o arguments. Generated with sed.

branches: 1.72.2; 1.72.4; 1.72.8; 1.72.12;
PR kern/39307 (mfs will sometimes panic at umount time)

Change dounmount() so that it never drops the caller provided reference.
Garbage collecting 'struct mount' is up to the caller.

branches: 1.71.2; 1.71.6;
PR kern/38141 lookup/vfs_busy acquire rwlock recursively

Simplify the mount locking. Remove all the crud to deal with recursion on
the mount lock, and crud to deal with unmount as another weirdo lock.

Hopefully this will once and for all fix the deadlocks with this. With this
commit there are two locks on each mount:

- krwlock_t mnt_unmounting. This is used to prevent unmount across critical
sections like getnewvnode(). It's only ever read locked with rw_tryenter(),
and is only ever write locked in dounmount(). A write hold can't be taken
on this lock if the current LWP could hold a vnode lock.

- kmutex_t mnt_updating. This is taken by threads updating the mount, for
example when going r/o -> r/w, and is only present to serialize updates.
In order to take this lock, a read hold must first be taken on
mnt_unmounting, and the two need to be held across the operation.

One effect of this change: previously if an unmount failed, we would make a
half hearted attempt to back out of it gracefully, but that was unlikely to
work in a lot of cases. Now while an unmount that will be aborted is in
progress, new file operations within the mount will fail instead of being
delayed. That is unlikely to be a problem though, because if the admin
requests unmount of a file system then s(he) has made a decision to deny
access to the resource.

PR kern/38135 vfs_busy/vfs_trybusy confusion

The previous fix worked, but it opened a window where mounts could have
disappeared from mountlist while the caller was traversing it using
vfs_trybusy(). Fix that.

kern/38135 vfs_busy/vfs_trybusy confusion

The symptom was that sometimes file systems would occasionally not appear
in output from 'df' or 'mount' if the system was busy. Resolution:

- Make mount locks work somewhat like vm_map locks.
- vfs_trybusy() now only fails if the mount is gone, or if someone is
unmounting the file system. Simple contention on mnt_lock doesn't
cause it to fail.
- vfs_busy() will wait even if the file system is being unmounted.

branches: 1.68.6; 1.68.8; 1.68.10;
- Needs sys/atomic.h for atomic_inc_uint()
- Quench compiler warning about signed/unsigned mismatch when building LKM

Expunge references to lockmgr.

Make it compile. I'll leave it to pooka to figure out what is the correct
thing here because I don't understand what this code is doing.

PR kern/37706 (forced unmount of file systems is unsafe):

- Do reference counting for 'struct mount'. Each vnode associated with a
mount takes a reference, and in turn the mount takes a reference to the
vfsops.
- Now that mounts are reference counted, replace the overcomplicated mount
locking inherited from 4.4BSD with a recursable rwlock.

For code clarity typedef void *puffs_cookie_t.

No functional change.

silence gcc about break type-punning

Merge vmlocking2 to head.

branches: 1.61.4;
Send a response message for flush operations from the kernel instead
of abusing the return value of write(2).

branches: 1.60.2;
In case the userspace wait is interrupted, don't use ERESTART as
the return value, rather use EINTR.

reported by Reinoud

Retire M_PUFFS, use kmem(9) instead.

fix some debug prints

Restructure the messaging interface a bit more: make all interfacing
with the file server happen through puffs_msg_enqueue() and
puffs_msg_wait() instead of having a billion different routines.
Build the existing system upon these two. Most importantly though,
decouple insertation into the op queue from the actual wait. This
is useful for a number of reasons coming soon to a cvs repo near you.

Bounds-check responses from userspace.

* split the putter header into a kernel version and a userland version
+ install latter to /usr/include/dev/putter
* remove last dependencies to puffs from putter, it's completely
independent now

Move putter code from directly under dev/ to dev/putter/

no functional change

Part 2/n of extensive changes to request transport to/from userspace:

Rip the transport code completely out of puffs and generalize it
into an independent module which will be used for multiple purposes
in the future. This module is called the Pass-to-Userspace
Transporter (known as "putter" among friends).

This is very much work-in-progress and one dependency with puffs
remains: the request framing format.

The device name is still /dev/puffs, but that will change soon.

Users of puffs need the following in their kernel configs now:
pseudo-device putter

Merge from vmlocking:

- pool_cache changes.
- Debugger/procfs locking fixes.
- Other minor changes.

branches: 1.51.2;
Make some comments match current reality. No functional change.

Reference mountpoint when fetching operations and release waiters
in unmount.

Always provide caller information from the kernel based on curlwp.
(but don't deprecate the old puffs_cid interface just yet)

When doing a read operation, don't copy the whole kernel buffer to
userspace, since it doesn't contain any information yet. I should
still rework this more so this is just a quickie to get the read/write
style interface more up to speed with the ioctl version.

branches: 1.47.2;
Handle suspend and flush requests from the file server.

Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

g/c vntouser_req(), it's not used anymore

g/c the "sizeop" code previous used for ioctl/fcntl. It was already
commented out and has bitrotted beyond all recognition, so it needs
complete rethinking.

If kernel resource allocation fails after the file server has
committed something, issue an abort. The abort is done through
the regular op channel, e.g. failed mkdir leads to regular rmdir,
inactive and reclaim. No internal interface is planned currently
for the one file system out of a million which would implement it
to benefit from the one case in a billion where kernel resource
allocation actually does fail and out of that one case in a trillion
where internal vs. external would make a difference.

* better error checking: validate error values received from userland
to be vaild errno values
* include string describing error in PUFFS_ERR
* get rid of union in puffs_req, it's nothing but trouble
* pass pmp to async i/o callbacks

Add error notifications, which are used to deliver errors from the
kernel to the file server for silly things the file server did,
e.g. attempting to create a file with size VSIZENOTSET. The file
server can handle these as it chooses, but the default action is
for it to throw its hands in the air and sing "goodbye, cruel world,
it's over, walk on by".

branches: 1.40.4; 1.40.6; 1.40.8; 1.40.10;
add debug printf

branches: 1.39.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Move puffs to a two clause license where it already isn't so. And
as agc pointed out, even files with the third clause were already
effectively two clause because of a slight bug in the language...

Introduce noref setbacks, which the file server can use to signal
the kernel it has 0 references to the node in question. In other
words, this can be used to avoid inactive(), or, if the file server
does not implement inactive, prompt reclaim for removed nodes.

If the op was interrupted, decrease ops waiting for fetch from the
file server only if the op was still waiting for fetch (as opposed
to waiting for the response). Also, properly flag the possible
following inactive as an op for which we do not want to wait for
the response from the file server.

Introduce puffs "setbacks", which can be used to set certain flags
for nodes upon return from the userspace. Currently it can be used
to indicate that the file server should be notified of "inactive"
in case the file server has opted to not receive inactive every
time the reference count for a vnode drops to zero. (inactive is
a common event, almost never requires any action and must be executed
sychronously, so it is wasteful).

While doing this, cleanup the release-relock nonsense from the
vntouser*() arguments. It was never enabled and the whole LOCKEDVP()
concept was very broken to begin with.

Fix a problem introduced when I converted puffs to use newlock2:
when unmounting the file system in case of a certain timing (and
possibly some other conditions), a thread would wait on a condition
variable, while another thread broadcast the cv and immediately
proceeded to destroy it. The result was a system frozen completely
solid shorly after the process waiting for the cv woke up. So
introduce reference counting to synchronize destruction of the
resources in unmount.

I was able to repeat the problem only on my laptop in some special
cases, so I do not know how common it was. Ironically, killing
the file server process violently instead of unmount() didn't have
this problem because it never entered the unmount path from two
directions.

remember to flag park as done when we're done with it

Now that puffs_park is allocated from the heap and actually freed
by the userdead routine, don't do a TAILQ_FOREACH but rather an
honest for loop.

Take care not to access park->park_preq if the waiter is gone, as
that memory is no longer available.

don't mutex_enter() manually, we've already park_reference()d a few
lines earlier for entering the same mutex

make overspammy debug printf less overspammy

Fix one more bug from today's commit: don't remove the op for which
getops runs out of file server buffer space from the request queue.
Otherwise that operation silently vanishes and things go, well, quite
wrong.

fix two loop mutex botches in previous

Make it possible to interrupt waiters for fs operation completion
again. This is useful until locking is further developed and basically
any deadlocks can be solved by killing appropriate processes.

Thanks especially to Tommi Kyntola and Antti Louko for sitting down
with me and discussing resource ownership and locking strategies
in implementing this.

s/ppark/park/ to make all the variable names consistent - park is
always a pointer now. no functional change

* abstract ASYNCBIOREAD and let callers freely issue a callback called
from putop. even though there's only one user currently, makes code
more readable
* move "delta" to a standard parameter in vntouser and get rid of the
specialcase vntouser_delta

in userdead assign waiter return value only if there is a waiter for
a particular request

Convert spinlocks & sleep/wakeup to newlock2 locking stuff. Fix a
bunch of bugs.

* park structures are now always allocated from a pool instead of a
mixed stack/malloc allocation
* get rid of the whole adjbuf concept, always just alloc the maximal
amount of memory to satisfy a request
* little regression: don't allow interrupting wait from file system
to userspace; this had problems already before, but now the problems
really started to shine through. I'll try to make this work again
some day.
* fix bmap to return a sensible value in runp

* rework the page cache interaction a bit: cache metadata in the
kernel and flush it out all at once instead of continuous updating
* add support for delivering notifications to the file server about
when a page was written to (but disabled by default for now). the
file server can use this to request flushing or invalidating the
kernel page cache

branches: 1.20.2;
Support B_READ|B_ASYNC in strategy by calling biodone() directly
when the file server puts the result.

branches: 1.19.2; 1.19.4;
Make wait for the user file server PCATCHable. This makes it
possible to recover the system by just killing processes in case
a file server manages to recurse into itself either by fault of
file server implementation or by pilot error. The downside is that
the code is extremely hard to follow and practically screams out
for newlock2 (in addition to screaming "bug here"). The whole
PCATCH nonsense and induced megacomplexity can hopefully be avoided
in the future by tweaking other parts of the implementation.

branches: 1.18.2;
fstrans owner automatically gets a normal lock, don't need to lazy lock

pointed out by hannken

Change fstrans enum types to upper case.
No functional change.

From Antti Kantee <pooka@netbsd.org>

Initial attempt at suspend/snapshot support for userspace file
servers. This is still pretty much on the level "if it breaks ...".
It should work for single-threaded servers which handle one operation
from start to finish in one go. Also, it does not yet totally
correctly synchronize metadata and data in some cases. So needless
to say, it needs improvement, but it is possible that will have to
wait for some lock revampage.

debug print requests going into the queue

Store puffs_node's on lists hashed with the cookie value instead
of just one flat list.

branches: 1.13.2;
Don't allow calls to be queued while MOUNTING. We don't make any
kernel->server calls at that time and it allows a window where
operations use an incorrect root node cookie.

XXX: there's still a (very much smaller and biglock safe) race, but
that's going to be solved by some more thorough restructuring

Don't return EWOULDBLOCK in case we have delivered some requests
even if we are operating on a nonblocking descriptor.

PCATCH in tsleep while waiting for operations in getop. Otherwise
we could end up in an unkillable deadlock if GETOP was called when
an operation that had locked the root vnode was already in userspace.

branches: 1.10.2;
shuffle functions around a bit: move the transport (/dev/puffs) to
a different file from the messaging (request contents). no functional
change

Allow multiple requests to be transferred in each GET/PUTOP. For
a single request, the performance is still the same.

if we are going to bail due to the mountpoint being gone from under
us while waiting for syncer lock, release the newly acquired syncer
lock prior to bailing

cosmetics

branches: 1.6.2;
Fix a race condition with unmount where the mountpoint might disappear
from under us while waiting for syncer_lock and before we got to vfs_busy.
This happens easily e.g. when the userspace server loses its will to
live in VOP_RECLAIM, which is called from vflush() in VFS_UNMOUNT. We
get two competing unmounters. When the first one finishes, it releases
syncer_lock. Now the second one tries to vfs_busy(), but is greeted
with garbage in *mp.

XXX: Technically this is a more general issue and should be fixed
elsewhere, but it's hard to trigger it with normal file systems
unless they are unmounted "simultaneously" twice and are dirty
enough for flushing to take a while. So make a note about it in
the little black book next to the poems and postpone the crusade
for now.

few renames to better differentiate between mount & start.. plus some
other renaming

attach to genfs & support page cache. most noticeable effect is
mmap and therefore execution of binaries starting to work, some
speed improvements with large file I/O also. caching semantics
and error case handling most likely need revisiting.

puffs_park always contains a specific puffs_req, so make it a member
instead of a pointer

If the control descriptor is closed, mark userspace dead and wakeup
all waiters *before* trying to get the syncer lock necessary for
dounmount(). This prevents a deadlock if the userspace server dies
while the syncer is running.

kernel portion of puffs - the Pass-to-Userspace Framework File System.
It contains the VFS attachment and userspace message-passing interface.

This work was initially started and completed for Google SoC 2005
and tweaked to work a bit better in the past few weeks. While
being far from complete, it is functional enough to be able and
stable to host a fairly general-purpose in-memory file system in
userspace. Even so, puffs should be considered experimental and
no binary compatibility for interfaces or crash-freedom or zero
security implications should be relied upon just yet.

The GSoC project was mentored by William Studenmund and the final
review for the code was done by Christos.

Avoid using register_t in <fs/puffs/puffs_msgif.h>

The purpose of this header file is to interface between the
kernel-space and user-space, and is #include'd by a user-space header
<puffs.h>. It should therefore not use any of kernel-only types, as
it's not reasonable to require user-land filesystems to #define
_KERNTYPES.

give names to the enums so we can cast by name for lint

branches: 1.85.8;
Restore binary compatibility by using the statvfs90 structure internally.

branches: 1.84.18;
Add PUFFS_KFLAG_NOFLUSH_META to prevent sending metadata flush to FUSE

FUSE filesystems do not expect to get metadata updates for [amc]time
and size, they updates the value on their own after operations.

The PUFFS PUFFS_KFLAG_NOFLUSH_META option prevents regular metadata cache
flushes to the filesystem , and libperfuse uses it to match Linux FUSE
behavior.

While there, fix a bug in SETATTR: do not update kernel metadata cache
from SETATTR reply when the request is asynchronous, as we do not have
the reply yet.

branches: 1.83.2;
Add PUFFS_HAVE_FALLOCATE in puffs_msgif.h so that filesystem can decide
at build time wether fallocate is usable

Add PUFFS support for fallocate and fdiscard operations

Add a oflags input field to open requests so that the filesystem can pass
back information about the file. Implement PUFFS_OPEN_IO_DIRECT, which
will force direct IO (bypassing page cache) for the file.

branches: 1.80.2; 1.80.14;
Add PUFFS_KFLAG_CACHE_DOTDOT so that vnodes hold a reference on their
parent, keeping them active, and allowing to lookup .. without sending
a request to the filesystem.

Enable the featuure for perfused, as this is how FUSE works.

- Improve PUFFS_KFLAG_CACHE_FS_TTL by reclaiming older inactive nodes.

The normal kernel behavior is to retain inactive nodes in the freelist
until it runs out of vnodes. This has some merit for local filesystems,
where the cost of an allocation is about the same as the cost of a
lookup. But that situation is not true for distributed filesystems.
On the other hand, keeping inactive nodes for a long time hold memory
in the file server process, and when the kernel runs out of vnodes, it
produce reclaim avalanches that increase lattency for other operations.

We do not reclaim inactive vnodes immediatly either, as they may be
looked up again shortly. Instead we introduce a grace time and we
reclaim nodes that have been inactive beyond the grace time.

- Fix lookup/reclaim race condition.

The above improvement undercovered a race condition between lookup and
reclaim. If we reclaimed a vnode associated with a userland cookie while
a lookup returning that same cookiewas inprogress, then the kernel ends
up with a vnode associated with a cookie that has been reclaimed in
userland. Next operation on the cookie will crash (or at least confuse)
the filesystem.

We fix this by introducing a lookup count in kernel and userland. On
reclaim, the kernel sends the count, which enable userland to detect
situation where it initiated a lookup that is not completed in kernel.
In such a situation, the reclaim must be ignored, as the node is about
to be looked up again.

Add name and atttribute cache with filesytem provided TTL.
lookup, create, mknod, mkdir, symlink, getattr and setattr messages
have been extended so that attributes and their TTL can be provided
by the filesytem. lookup, create, mknod, mkdir, and symlink messages
are also extended so that the filesystem can provide name TTL.

branches: 1.77.2; 1.77.6; 1.77.8;
don't get affected by the NAME_MAX bump. Use the same constant as the
rest of the extrattr code.

Add a flag to VOP_LISTEXTATTR(9) so that the vnode interface can tell the
filesystem in which format extended attribute shall be listed.

There are currently two formats:
- NUL-terminated strings, used for listxattr(2), this is the default.
- one byte length-pprefixed, non NUL-terminated strings, used for
extattr_list_file(2), which is obtanined by setting the
EXTATTR_LIST_PREFIXLEN flag to VOP_LISTEXTATTR(9)

This approach avoid the need for converting the list back and forth, except
in libperfuse, since FUSE uses NUL-terminated strings, and the kernel may
have requested EXTATTR_LIST_PREFIXLEN.

Add compat to enable running puffs in a 64bit time_t kernel against
a server which runs in 32bit time_t namespace.

Make retval argument for pathconf a register_t to match VOP_PATHCONF.
This makes the size the same on 64bit archs. Don't bother bumping
any version, since you'd have explicitly had to jump through some
hoops to use pathconf before.

add option string for no attribute cache
(foreseeing the odd event I might actually implement one some day)

Since libpuffs needs a major bump for extattr support anyway, make
some changes to the user-kernel protocol. Namely, try to be a
little more resilient some future changes.

Support extended attributes.

Fix typo.

branches: 1.69.2; 1.69.4;
Add a PUFFS_UNMOUNT server->kernel request, which causes the kernel
to initiate self destruct, i.e. unmount(MNT_FORCE). This, however,
is a semi-controlled self-destruct, since all caches are flushed
before the (possibly) violent unmount takes place.

Bump protocol version once more to allow for previous to be pulled
to netbsd-5 (protocols are not compatible due to time_t/dev_t
change).

Transmit VOP_ABORTOP() to the server.

Bump interface version number for the time_t/dev_t changes.

branches: 1.65.6; 1.65.10; 1.65.18; 1.65.20; 1.65.26;
For code clarity typedef void *puffs_cookie_t.

No functional change.

Now that "l" is gone both as an argument to operations and from
componentname, remove all vestiges of puffs_cid.

Send a response message for flush operations from the kernel instead
of abusing the return value of write(2).

Add a bit to differentiate if a message is a request or a response.

branches: 1.61.2;
Remove "puffs_cid" from the puffs interface following l-removal
from the kernel vfs interfaces. puffs_cc_getcaller(pcc) can be
used now should the same information be desired.

* split the putter header into a kernel version and a userland version
+ install latter to /usr/include/dev/putter
* remove last dependencies to puffs from putter, it's completely
independent now

branches: 1.59.2;
Always provide caller information from the kernel based on curlwp.
(but don't deprecate the old puffs_cid interface just yet)

When doing a read operation, don't copy the whole kernel buffer to
userspace, since it doesn't contain any information yet. I should
still rework this more so this is just a quickie to get the read/write
style interface more up to speed with the ioctl version.

branches: 1.57.2;
g/c garbage

Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

g/c the "sizeop" code previous used for ioctl/fcntl. It was already
commented out and has bitrotted beyond all recognition, so it needs
complete rethinking.

If kernel resource allocation fails after the file server has
committed something, issue an abort. The abort is done through
the regular op channel, e.g. failed mkdir leads to regular rmdir,
inactive and reclaim. No internal interface is planned currently
for the one file system out of a million which would implement it
to benefit from the one case in a billion where kernel resource
allocation actually does fail and out of that one case in a trillion
where internal vs. external would make a difference.

* better error checking: validate error values received from userland
to be vaild errno values
* include string describing error in PUFFS_ERR
* get rid of union in puffs_req, it's nothing but trouble
* pass pmp to async i/o callbacks

nuke trailing , from enum. spotted by xtraeme

Add error notifications, which are used to deliver errors from the
kernel to the file server for silly things the file server did,
e.g. attempting to create a file with size VSIZENOTSET. The file
server can handle these as it chooses, but the default action is
for it to throw its hands in the air and sing "goodbye, cruel world,
it's over, walk on by".

branches: 1.50.2; 1.50.4;
Add a third type of fh option, passthrough, where the kernel does
not attempt to handle struct fid at all and passes it as such to
userspace.

Mimic namei structure changes for puffs. bump both kernel & lib version.

Nuke PUFFSLOOKUP_FOO and move to NAMEI_FOO

branches: 1.47.4; 1.47.6;
Move PUFFS_TYPEPREFIX to puffs_msgif.h since it's used in a macro there.

include <uvm/uvm_prot.h>

Change unused fflags parameter in VOP_MMAP to prot and pass in
desired vm protection.

define PUFFSREQSIZEOP ioctl, which can be used to fetch the
maximum request size

kill MFSNAMELEN limit

branches: 1.42.2;
Set a file server supplied file system type in the type field and set
the mntfromname to be the place mounted from instead of the type.

1|2 is more correct when it's 3 instead of 2. This makes calls to
the file server inactive less over-eagerly executed and masks some
problems with the new mounting style. Effectively, it makes some
file systems such as psshfs mountable again (only without -o allops).

support turning REQUIREDIR off and extra consume in lookup

Get rid of the "int *refs" parameter to inactive: the same can be
accomplished now with puffs_setbacks.

Give the file server to ability to request the entire pathname buffer
under lookup by using PUFFS_KFLAG_LOOKUP_FULLPNBUF instead just the
current component.

Instead of supplying a plain pid, supply an abstract struct puffs_cid *,
which can currently be used to query the pid and lwpid.

make puffs_cred an opaque type

Actually, keep PUFFS_KFLAG_NOCACHE and -o cache around as shorthand
to neither page- nor namecache.

Split the NOCACHE option in twain: NOCACHE_NAME & NOCACHE_PAGE.

Move puffs to a two clause license where it already isn't so. And
as agc pointed out, even files with the third clause were already
effectively two clause because of a slight bug in the language...

Introduce noref setbacks, which the file server can use to signal
the kernel it has 0 references to the node in question. In other
words, this can be used to avoid inactive(), or, if the file server
does not implement inactive, prompt reclaim for removed nodes.

Support VOP_POLL. This requires some acrobatics on the puffs_node,
as we give a reference to userspace for the puffs_node for the
duration of the poll call. So reference count puffs_node separately
from the parent vnode. vref()/vrele() is not possible due to a possible
surprise visit from VOP_INACTIVE.

Make it possible for the file server to specify the root vnode type
and other information instead of always using VDIR. To make this
possible without races, require all root node information already
in puffs_mount() and nuke puffs_start2() and the associated start
operation completely.

requested/inspired by Tobias Nygren

Introduce puffs "setbacks", which can be used to set certain flags
for nodes upon return from the userspace. Currently it can be used
to indicate that the file server should be notified of "inactive"
in case the file server has opted to not receive inactive every
time the reference count for a vnode drops to zero. (inactive is
a common event, almost never requires any action and must be executed
sychronously, so it is wasteful).

While doing this, cleanup the release-relock nonsense from the
vntouser*() arguments. It was never enabled and the whole LOCKEDVP()
concept was very broken to begin with.

define PUFFS_KFLAG_WTCACHE, which makes the page cache write-through

Give the file server the ability to specify the file handle length
instead of defining a static length file handle on the framework-level.

Allow file servers to request the number of hash cookie buckets for
pnode -> vnode reverse lookup.

* add fhlen to kernel argument structure
* rename it to puffs_kargs instead of puffs_args

* support VFS_FHTOVP and VFS_VPTOFH
* support cookies in for VOP_READDIR

nfs exporting puffs file systems works now

actually, we don't need a separate op for flushing the whole page cache
of a node, just use the range op with endoff = 0

Convert spinlocks & sleep/wakeup to newlock2 locking stuff. Fix a
bunch of bugs.

* park structures are now always allocated from a pool instead of a
mixed stack/malloc allocation
* get rid of the whole adjbuf concept, always just alloc the maximal
amount of memory to satisfy a request
* little regression: don't allow interrupting wait from file system
to userspace; this had problems already before, but now the problems
really started to shine through. I'll try to make this work again
some day.
* fix bmap to return a sensible value in runp

export puffs version of namei ISLASTCN macro to userspace

* rework the page cache interaction a bit: cache metadata in the
kernel and flush it out all at once instead of continuous updating
* add support for delivering notifications to the file server about
when a page was written to (but disabled by default for now). the
file server can use this to request flushing or invalidating the
kernel page cache

branches: 1.19.2; 1.19.6; 1.19.8; 1.19.10;
Initial attempt at suspend/snapshot support for userspace file
servers. This is still pretty much on the level "if it breaks ...".
It should work for single-threaded servers which handle one operation
from start to finish in one go. Also, it does not yet totally
correctly synchronize metadata and data in some cases. So needless
to say, it needs improvement, but it is possible that will have to
wait for some lock revampage.

g/c revoke msg structure

comment out flushmulti for now, it's not done and kdump will complain
as mjf noted

Introduce flush operations, which the fs server can use to control
kernel caching. Currently supported are only flushing the name
cache for a directory or flushing the name cache for the entire fs.

Also, get rid of PNODE_INACTIVE status, since it was racy and
essentially didn't work. All this on top of being useless in the
first place ....

vfs sync, flushes regular file data only (user server can take care of
flushing any metadata it might have hidden away)

* check userspace version and prevent incompatible mount
* some general maintenance

branches: 1.13.2;
rename the kernel-provided componentname to puffs_kcn; libpuffs now
provides puffs_cn built on top of it

branches: 1.12.2;
let implementation ultimately decide if mmap is supported - pass
VOP_MMAP to fs server

Allow multiple requests to be transferred in each GET/PUTOP. For
a single request, the performance is still the same.

prefix kernel flags with PUFFS_KFLAG to have a separate namespace
from the library flags

don't call the fs server for all operations, only those it has told
us that it implements

branches: 1.8.2;
Require statvfs info from startreq so that we have that info available.
Also, don't pass fsid to userspace and just fill it in the kernel.

Introduce uncached operation, makes sense when the file system backend
can be modified from elsewhere than the file system interface

few renames to better differentiate between mount & start.. plus some
other renaming

attach to genfs & support page cache. most noticeable effect is
mmap and therefore execution of binaries starting to work, some
speed improvements with large file I/O also. caching semantics
and error case handling most likely need revisiting.

support specfs

pass VOP_INACTIVE() to userspace

bump the reqstruct minsize to something more believable (but I should
really fix this, still)

kernel portion of puffs - the Pass-to-Userspace Framework File System.
It contains the VFS attachment and userspace message-passing interface.

This work was initially started and completed for Google SoC 2005
and tweaked to work a bit better in the past few weeks. While
being far from complete, it is functional enough to be able and
stable to host a fairly general-purpose in-memory file system in
userspace. Even so, puffs should be considered experimental and
no binary compatibility for interfaces or crash-freedom or zero
security implications should be relied upon just yet.

The GSoC project was mentored by William Studenmund and the final
review for the code was done by Christos.

Typos.

Remove now obsolete operation vcache_remove().

Welcome to 7.99.36

branches: 1.36.2;
Do not uselessly include <sys/malloc.h>.

Fix PUFFS node use-after-reclaim

When puffs_cookie2vnode() misses an entry, vcache_get()
creates a new node (puffs_vfsop_loadvnode being called to
initialize the PUFFS part), then it discovers it is VNON,
and tries to vrele() it. vrele() calls VOP_INACTIVE(),
which led us in puffs_vnop_inactive() where we sent a
request to the filesystem for a node that already had been
reclaimed.

The fix is to check for VNON nodes in puffs_vnop_inactive()
and to return without doing anyting. This is suboptimal, but
a better workaround would probably need to modify vcache API,
with an impact on other filesystems. Let us keep it simple.

Fix the puffs_sop_thread -> puffs_cookie2vnode path:
- pass the cookie by reference
- add missing mutex_exit()
- update assertion for VNON typed vnodes

When changing a directory content, update the ctime/mtime in kernel cache,
otherwise the updated ctime/mtime appears after the cached entry expire.

Change puffs from hashlist to vcache.
- field "pa_nhashbuckets" of struct "puffs_kargs" becomes a no-op.
and should be removed on the next protocol version bump.

branches: 1.31.4;
Change vnode operations create, mknod, mkdir and symlink to return
the resulting vnode *vpp unlocked.

Discussed on tech-kern@

Welcome to 6.99.30

- remove unused variables
- add _NOERROR flavor macros for the case where errors are ignored.

branches: 1.29.6;
comments
use sizeof(var) instead of sizeof(type) where possibly confusing

Excise struct componentname from the namecache.

This uglifies the interface, because several operations need to be
passed the namei flags and cache_lookup also needs for the time being
to be passed cnp->cn_nameiop. Nonetheless, it's a net benefit.

The glop should be able to go away eventually but requires structural
cleanup elsewhere first.

This change requires a kernel bump.

branches: 1.27.2;
Backout NCHNAMLEN check for cache_enter. That change collided with rmind's
move of this exact check into cache_enter

Di not call cache_enter with path components bigger than NCHNAMLEN, as it
panics the kernel.

Move some the test for MAKEENTRY into the cache_enter(9). Make some
variables in vfs_cache.c static, __read_mostly, etc.

No objection on tech-kern@.

Add name and atttribute cache with filesytem provided TTL.
lookup, create, mknod, mkdir, symlink, getattr and setattr messages
have been extended so that attributes and their TTL can be provided
by the filesytem. lookup, create, mknod, mkdir, and symlink messages
are also extended so that the filesystem can provide name TTL.

branches: 1.23.2;
Fix a race condition where the filesystem lookups a vnode that is
being recycled, producing ENOENT while the file does exist.

Approved by yamt

branches: 1.22.2; 1.22.6;
Remove #ifdef DIAGNOSTIC guards around KASSERT, as the macro contains them

Make sure pagedaemon does not sleep for memory in puffs_vnop_sleep.
Add KASSERT on any sleeping memory allocation to check it cannot happen again.

Add a mutex for operations that touch size (setattr, getattr, write, fsync).

This is required to avoid data corruption bugs, where a getattr slices
itself within a setattr operation, and sets the size to the stall value
it got from the filesystem. That value is smaller than the one set by
setattr, and the call to uvm_vnp_setsize() trigged a spurious truncate.
The result is a chunk of zeroed data in the file.

Such a situation can easily happen when the ioflush thread issue a
VOP_FSYNC/puffs_vnop_sync/flushvncache/dosetattrn while andother process
do a sys_stat/VOP_GETATTR/puffs_vnop_getattr.

This mutex on size operation can be removed the day we decide VOP_GETATTR
has to operated on a locked vnode, since the other operations that touch
size already require that.

dependant -> dependent

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.17.6;
It makes no sense to call vget() with LK_RETRY.

Make holding v_interlock mandatory for callers of vget().

Announced some time ago on tech-kern.

branches: 1.15.2; 1.15.4;
Kill suspend support. It was never implemented correctly:
* it depended on the biglock (in a very cruel way)
* it was attached to userspace transactions rather than logical
fs operations

(If someone wants to revisit it some day, most of the stuff can be
reused from cvs history)

* fix a race i introduced almost two years ago in rev 1.116:
operations creating a node cannot be considered outgoing operations,
since after return from userspace they modify file system state
by creating a new node. if we do not protect the file system by
holding the directory lock, a lookup operation might race us into
the kernel and create the node earlier.
* remove pnode from hashlish before sending the reclaim faf off to
userspace. also, hold pmp_lock while frobbing the list.

branches: 1.13.10; 1.13.18;
PR kern/37950 Unmounting psshfs immediately panics the machine

puffs_getvnode() was inserting vnodes into mnt_vnodelist without taking
a reference to the mount for each. When vnodes are scrubbed, refs to the
vnodes mount structure are dropped => boom.

branches: 1.12.2; 1.12.4;
Welcome to 4.99.55:

- Add a lot of missing selinit() and seldestroy() calls.

- Merge selwakeup() and selnotify() calls into a single selnotify().

- Add an additional 'events' argument to selnotify() call. It will
indicate which event (POLL_IN, POLL_OUT, etc) happen. If unknown,
zero may be used.

Note: please pass appropriate value of 'events' where possible.
Proposed on: <tech-kern>

branches: 1.11.2; 1.11.6;
For code clarity typedef void *puffs_cookie_t.

No functional change.

specfs changes for PR kern/37717 (raidclose() is no longer called on
shutdown). There are still problems with device access and a PR will be
filed.

- Kill checkalias(). Allow multiple vnodes to reference a single device.

- Don't play dangerous tricks with block vnodes to ensure that only one
vnode can describe a block device. Instead, prohibit concurrent opens of
block devices. As a bonus remove the unreliable code that prevents
multiple file system mounts on the same device. It's no longer needed.

- Track opens by vnode and by device. Issue cdev_close() when the last open
goes away, instead of abusing vnode::v_usecount to tell if the device is
open.

Merge vmlocking2 to head.

branches: 1.8.2; 1.8.6;
Make puffs_updatenode() take a puffs_node instead of a vnode. This
way we don't need to worry if a vnode has been reclaimed from under
us.

Restructure the messaging interface a bit more: make all interfacing
with the file server happen through puffs_msg_enqueue() and
puffs_msg_wait() instead of having a billion different routines.
Build the existing system upon these two. Most importantly though,
decouple insertation into the op queue from the actual wait. This
is useful for a number of reasons coming soon to a cvs repo near you.

branches: 1.6.2; 1.6.4; 1.6.6; 1.6.8;
Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

Merge from vmlocking:

- Split vnode::v_flag into three fields, depending on field locking.
- simple_lock -> kmutex in a few places.
- Fix some simple locking problems.

branches: 1.4.2; 1.4.4; 1.4.6;
If kernel resource allocation fails after the file server has
committed something, issue an abort. The abort is done through
the regular op channel, e.g. failed mkdir leads to regular rmdir,
inactive and reclaim. No internal interface is planned currently
for the one file system out of a million which would implement it
to benefit from the one case in a billion where kernel resource
allocation actually does fail and out of that one case in a trillion
where internal vs. external would make a difference.

* better error checking: validate error values received from userland
to be vaild errno values
* include string describing error in PUFFS_ERR
* get rid of union in puffs_req, it's nothing but trouble
* pass pmp to async i/o callbacks

comments & other minor maintenance

Split routines handling nodes from puffs_subr to puffs_node.
No functional change.

Do not uselessly include <sys/malloc.h>.

branches: 1.66.26; 1.66.42;
more <sys/buf.h> police

branches: 1.65.4; 1.65.10; 1.65.12;
Welcome to 4.99.55:

- Add a lot of missing selinit() and seldestroy() calls.

- Merge selwakeup() and selnotify() calls into a single selnotify().

- Add an additional 'events' argument to selnotify() call. It will
indicate which event (POLL_IN, POLL_OUT, etc) happen. If unknown,
zero may be used.

Note: please pass appropriate value of 'events' where possible.
Proposed on: <tech-kern>

branches: 1.64.2; 1.64.6;
For code clarity typedef void *puffs_cookie_t.

No functional change.

More type-punning workarounds. Curiously the kernel compilation
flags cause gcc to not complain.

branches: 1.62.4;
Now that "l" is gone both as an argument to operations and from
componentname, remove all vestiges of puffs_cid.

Remove cn_lwp from struct componentname. curlwp should be used
from on. The NDINIT() macro no longer takes the lwp parameter and
associates the credentials of the calling thread with the namei
structure.

branches: 1.60.2;
Make puffs_updatenode() take a puffs_node instead of a vnode. This
way we don't need to worry if a vnode has been reclaimed from under
us.

Implement a biodone callback for async writes similar to reads and
use that when possible.

Restructure the messaging interface a bit more: make all interfacing
with the file server happen through puffs_msg_enqueue() and
puffs_msg_wait() instead of having a billion different routines.
Build the existing system upon these two. Most importantly though,
decouple insertation into the op queue from the actual wait. This
is useful for a number of reasons coming soon to a cvs repo near you.

branches: 1.57.2; 1.57.4;
Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

Merge from vmlocking:

- Split vnode::v_flag into three fields, depending on field locking.
- simple_lock -> kmutex in a few places.
- Fix some simple locking problems.

* better error checking: validate error values received from userland
to be vaild errno values
* include string describing error in PUFFS_ERR
* get rid of union in puffs_req, it's nothing but trouble
* pass pmp to async i/o callbacks

kill trailing whitespace

Split routines handling nodes from puffs_subr to puffs_node.
No functional change.

Revert previous, it makes no sense whatsoever.

Undo state created in cookie2vnode if an error is returned.

Differentiate between cookie2vnode returning an error and
return to caller, address unknown: no such cookie, no such node.
Make the callers use this info to either create a new vnode or bail.

Add error notifications, which are used to deliver errors from the
kernel to the file server for silly things the file server did,
e.g. attempting to create a file with size VSIZENOTSET. The file
server can handle these as it chooses, but the default action is
for it to throw its hands in the air and sing "goodbye, cruel world,
it's over, walk on by".

Don't forget to insert the root node on the hash list.

... I should remember to test also if unmounting a file system works
before I commit stuff.

Fix a race in how new cookies are checked. Previously the checking
was done separate of inserting the cookie into the lookup structure
and without any form of interlock. This could lead to the same
cookie pointing to two different nodes. Remedy the race by creating
a separate "checked and ready to be inserted" cookie list which
serves as an interlock without having to hold a fs-global creation
lock.

add a few comments and g/c dead code

branches: 1.45.2;
* don't allow the file server to specify a node size to be VSIZENOTSET
* KASSERT that VNOVAL == VSIZENOTSET

branches: 1.44.2; 1.44.4; 1.44.6;
add comment to flag a slight problem

It's not a good idea for device drivers to modify b_flags, as they don't
need to understand the locking around that field. Instead of setting
B_ERROR, set b_error instead. b_error is 'owned' by whoever completes
the I/O request.

Keep track of the maximum size we have supplied the file server (or
it has supplied us). If we fault pages which are at offset >= server
size, but less than the in-kernel vnode size, inform the file server
of the latest developments in file size before issueing the fault.
The avoids confusion with files which are not written start to finish.

fixes kern/36429 by yamt

Initialize pnode to 0 after fetching it from the pool. At least
one effect is poll() working much better, as selinfo doesn't contain
random bits.

branches: 1.40.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

check for invalid vtype

Give the file server to ability to request the entire pathname buffer
under lookup by using PUFFS_KFLAG_LOOKUP_FULLPNBUF instead just the
current component.

Instead of supplying a plain pid, supply an abstract struct puffs_cid *,
which can currently be used to query the pid and lwpid.

make puffs_cred an opaque type

Split the NOCACHE option in twain: NOCACHE_NAME & NOCACHE_PAGE.

Refactor the pnode2vnode translation slightly so that VFS_ROOT
can use it directly.

Reorganize how the root vnode is fetched so that it doesn't always
go through VFS_ROOT() and allow to fetch it without locking it.
This allows us to call the cache flush operations also for the root
vnode and most notably fixes e.g. a "No such file or directory"
for a psshfs root directory ls -l when a file was locally deleted
and remotely re-created.

Also fix some sloppy programming in root node fetch (mostly cosmetic).

Move puffs to a two clause license where it already isn't so. And
as agc pointed out, even files with the third clause were already
effectively two clause because of a slight bug in the language...

Support VOP_POLL. This requires some acrobatics on the puffs_node,
as we give a reference to userspace for the puffs_node for the
duration of the poll call. So reference count puffs_node separately
from the parent vnode. vref()/vrele() is not possible due to a possible
surprise visit from VOP_INACTIVE.

Make it possible for the file server to specify the root vnode type
and other information instead of always using VDIR. To make this
possible without races, require all root node information already
in puffs_mount() and nuke puffs_start2() and the associated start
operation completely.

requested/inspired by Tobias Nygren

Adventures in file systems, part (u_quad_t)-1: we can't use the
file system value for the size of device special files, as that
comes from specfs instead of the "host" file system. Therefore,
take care that getattr doesn't override the value of vp->v_size.

Fix a problem introduced when I converted puffs to use newlock2:
when unmounting the file system in case of a certain timing (and
possibly some other conditions), a thread would wait on a condition
variable, while another thread broadcast the cv and immediately
proceeded to destroy it. The result was a system frozen completely
solid shorly after the process waiting for the cv woke up. So
introduce reference counting to synchronize destruction of the
resources in unmount.

I was able to repeat the problem only on my laptop in some special
cases, so I do not know how common it was. Ironically, killing
the file server process violently instead of unmount() didn't have
this problem because it never entered the unmount path from two
directions.

* abstract ASYNCBIOREAD and let callers freely issue a callback called
from putop. even though there's only one user currently, makes code
more readable
* move "delta" to a standard parameter in vntouser and get rid of the
specialcase vntouser_delta

Convert spinlocks & sleep/wakeup to newlock2 locking stuff. Fix a
bunch of bugs.

* park structures are now always allocated from a pool instead of a
mixed stack/malloc allocation
* get rid of the whole adjbuf concept, always just alloc the maximal
amount of memory to satisfy a request
* little regression: don't allow interrupting wait from file system
to userspace; this had problems already before, but now the problems
really started to shine through. I'll try to make this work again
some day.
* fix bmap to return a sensible value in runp

* rework the page cache interaction a bit: cache metadata in the
kernel and flush it out all at once instead of continuous updating
* add support for delivering notifications to the file server about
when a page was written to (but disabled by default for now). the
file server can use this to request flushing or invalidating the
kernel page cache

branches: 1.24.2;
Support B_READ|B_ASYNC in strategy by calling biodone() directly
when the file server puts the result.

branches: 1.23.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.22.2;
Make wait for the user file server PCATCHable. This makes it
possible to recover the system by just killing processes in case
a file server manages to recurse into itself either by fault of
file server implementation or by pilot error. The downside is that
the code is extremely hard to follow and practically screams out
for newlock2 (in addition to screaming "bug here"). The whole
PCATCH nonsense and induced megacomplexity can hopefully be avoided
in the future by tweaking other parts of the implementation.

Call genfs_node_destroy() where appropriate.

branches: 1.20.2;
Check against root node cookie when fetching a new vnode and invoke
VFS_ROOT() if the cookies match. Without this fix, if the root
vnode was reclaimed, doing lookups for dotdot from the root vnode
was possible. In practice this occured only through getcwd.

Hide the debug prints behind PUFFSDEBUG instead of DEBUG. Make the
latter define the former.

Initial attempt at suspend/snapshot support for userspace file
servers. This is still pretty much on the level "if it breaks ...".
It should work for single-threaded servers which handle one operation
from start to finish in one go. Also, it does not yet totally
correctly synchronize metadata and data in some cases. So needless
to say, it needs improvement, but it is possible that will have to
wait for some lock revampage.

don't hold spinlocks (except vnode interlock) when doing vget()

Store puffs_node's on lists hashed with the cookie value instead
of just one flat list.

* do not accept the directory cookie as the result of a lookup (otherwise
we'd be locking against ourselves)
* do not accept duplicate cookies when creating new nodes

Introduce flush operations, which the fs server can use to control
kernel caching. Currently supported are only flushing the name
cache for a directory or flushing the name cache for the entire fs.

Also, get rid of PNODE_INACTIVE status, since it was racy and
essentially didn't work. All this on top of being useless in the
first place ....

branches: 1.13.2;
* use PUFFS_KFLAG_NOCACHE to also signal that we don't want the namecache
* enter files into the namecache immediately when new nodes are created
(if it's a caching mount, of course)

rename the kernel-provided componentname to puffs_kcn; libpuffs now
provides puffs_cn built on top of it

branches: 1.11.2;
shuffle functions around a bit: move the transport (/dev/puffs) to
a different file from the messaging (request contents). no functional
change

Allow multiple requests to be transferred in each GET/PUTOP. For
a single request, the performance is still the same.

branches: 1.9.2;
As a first generation best-effort hack, use NOCACHE to mean "file
size can change without the kernel knowing" and therefore query
the file size before invoking read or write operations.

__unused removal on arguments; approved by core.

attach to genfs & support page cache. most noticeable effect is
mmap and therefore execution of binaries starting to work, some
speed improvements with large file I/O also. caching semantics
and error case handling most likely need revisiting.

fix checkalias true branch: don't unlock or lock twice

support fifos

support specfs

Fix operations creating new nodes to honor the vnode locking protocol
if the userspace server returns an error. Fixes lockups if any
of the following operations failed: create, mknod, mkdir, symlink

Apply a little eggwash to a deadlock condition where calling
getnewvnode() while holding on to any vnode lock deadlocks the
system if the file system is being forcibly unmounted.

Normal file systems don't trigger this problem because of two reaons:
1) they don't hold on to vnode locks while idling who-knows-where, so
the race doesn't trigger
2) they aren't usually unmounted with FORCE; puffs is, in case "someone"
manages to make a crashy userspace server

Nevertheless, a real solution is slowly being braised.

kernel portion of puffs - the Pass-to-Userspace Framework File System.
It contains the VFS attachment and userspace message-passing interface.

This work was initially started and completed for Google SoC 2005
and tweaked to work a bit better in the past few weeks. While
being far from complete, it is functional enough to be able and
stable to host a fairly general-purpose in-memory file system in
userspace. Even so, puffs should be considered experimental and
no binary compatibility for interfaces or crash-freedom or zero
security implications should be relied upon just yet.

The GSoC project was mentored by William Studenmund and the final
review for the code was done by Christos.

Merge the [pgoyette-compat] branch

branches: 1.90.16; 1.90.18;
KNF. Remove extra spaces. No functional change.

Add PUFFS_KFLAG_NOFLUSH_META to prevent sending metadata flush to FUSE

FUSE filesystems do not expect to get metadata updates for [amc]time
and size, they updates the value on their own after operations.

The PUFFS PUFFS_KFLAG_NOFLUSH_META option prevents regular metadata cache
flushes to the filesystem , and libperfuse uses it to match Linux FUSE
behavior.

While there, fix a bug in SETATTR: do not update kernel metadata cache
from SETATTR reply when the request is asynchronous, as we do not have
the reply yet.

branches: 1.88.2;
Add close brace, accidentally omitted from previous change.

Safer definitions of DPRINTF and DPRINTF_VERBOSE.

In the PUFFSDEBUG case, wrap do { ... } while (/*CONSTCOND*/0)
around the definitions. In the non-PUFFSDEBUG case, define them
as ((void)0) instead of as empty.

Change puffs from hashlist to vcache.
- field "pa_nhashbuckets" of struct "puffs_kargs" becomes a no-op.
and should be removed on the next protocol version bump.

Add a oflags input field to open requests so that the filesystem can pass
back information about the file. Implement PUFFS_OPEN_IO_DIRECT, which
will force direct IO (bypassing page cache) for the file.

branches: 1.84.4;
- remove unused variables
- add _NOERROR flavor macros for the case where errors are ignored.

branches: 1.83.6;
comment

branches: 1.82.2;
Missing bit in previous commit (PUFFS_KFLAG_CACHE_DOTDOT option to avoid
looking up ..)

Rename slow sopreq queue into node sopreq queue, to refet the fact that
is only intended for postponed node reclaims.
When purging the node sopreq queue, do not call puffs_msg_sendresp(), as
it makes no sense.

- Improve PUFFS_KFLAG_CACHE_FS_TTL by reclaiming older inactive nodes.

The normal kernel behavior is to retain inactive nodes in the freelist
until it runs out of vnodes. This has some merit for local filesystems,
where the cost of an allocation is about the same as the cost of a
lookup. But that situation is not true for distributed filesystems.
On the other hand, keeping inactive nodes for a long time hold memory
in the file server process, and when the kernel runs out of vnodes, it
produce reclaim avalanches that increase lattency for other operations.

We do not reclaim inactive vnodes immediatly either, as they may be
looked up again shortly. Instead we introduce a grace time and we
reclaim nodes that have been inactive beyond the grace time.

- Fix lookup/reclaim race condition.

The above improvement undercovered a race condition between lookup and
reclaim. If we reclaimed a vnode associated with a userland cookie while
a lookup returning that same cookiewas inprogress, then the kernel ends
up with a vnode associated with a cookie that has been reclaimed in
userland. Next operation on the cookie will crash (or at least confuse)
the filesystem.

We fix this by introducing a lookup count in kernel and userland. On
reclaim, the kernel sends the count, which enable userland to detect
situation where it initiated a lookup that is not completed in kernel.
In such a situation, the reclaim must be ignored, as the node is about
to be looked up again.

Add name and atttribute cache with filesytem provided TTL.
lookup, create, mknod, mkdir, symlink, getattr and setattr messages
have been extended so that attributes and their TTL can be provided
by the filesytem. lookup, create, mknod, mkdir, and symlink messages
are also extended so that the filesystem can provide name TTL.

branches: 1.78.2; 1.78.6; 1.78.8;
Add a mutex for operations that touch size (setattr, getattr, write, fsync).

This is required to avoid data corruption bugs, where a getattr slices
itself within a setattr operation, and sets the size to the stall value
it got from the filesystem. That value is smaller than the one set by
setattr, and the call to uvm_vnp_setsize() trigged a spurious truncate.
The result is a chunk of zeroed data in the file.

Such a situation can easily happen when the ioflush thread issue a
VOP_FSYNC/puffs_vnop_sync/flushvncache/dosetattrn while andother process
do a sys_stat/VOP_GETATTR/puffs_vnop_getattr.

This mutex on size operation can be removed the day we decide VOP_GETATTR
has to operated on a locked vnode, since the other operations that touch
size already require that.

add advlock to puffs. ok pooka@
should fix kern/43321

Add compat to enable running puffs in a 64bit time_t kernel against
a server which runs in 32bit time_t namespace.

branches: 1.75.2; 1.75.4;
Rename PUFFS_SOPREQ_EXIT to PUFFS_SOPREQSYS_EXIT to better signal
it comes from within the kernel instead of as a direct result of
a user request.

no functional change

Add a PUFFS_UNMOUNT server->kernel request, which causes the kernel
to initiate self destruct, i.e. unmount(MNT_FORCE). This, however,
is a semi-controlled self-destruct, since all caches are flushed
before the (possibly) violent unmount takes place.

Process flush requests from the file server in a separate thread
context. This fixes a long-standing but seldomly seen deadlock,
where the kernel was holding pages busy (due to e.g. readahead
request) while waiting for the server to respond, and the server
made a callback into the kernel asking to invalidate those pages.
... or, well, theoretically fixes, since I didn't have any reliable
way of repeating the deadlock and I think I saw it only twice.

Kill suspend support. It was never implemented correctly:
* it depended on the biglock (in a very cruel way)
* it was attached to userspace transactions rather than logical
fs operations

(If someone wants to revisit it some day, most of the stuff can be
reused from cvs history)

Reinstante PNODE_DYING. vmlocking had a brief hiatus when it was not
a valid optimization, but that's long gone and once VOP_INACTIVE is
called and the file server says that the vnode is going to be recycled,
it really is going to be recycled extra references gained or not.

branches: 1.70.10; 1.70.20; 1.70.28;
For code clarity typedef void *puffs_cookie_t.

No functional change.

More type-punning workarounds. Curiously the kernel compilation
flags cause gcc to not complain.

Merge vmlocking2 to head.

branches: 1.67.4;
Now that "l" is gone both as an argument to operations and from
componentname, remove all vestiges of puffs_cid.

Send a response message for flush operations from the kernel instead
of abusing the return value of write(2).

branches: 1.65.2;
Retire M_PUFFS, use kmem(9) instead.

Make puffs_updatenode() take a puffs_node instead of a vnode. This
way we don't need to worry if a vnode has been reclaimed from under
us.

Implement a biodone callback for async writes similar to reads and
use that when possible.

Restructure the messaging interface a bit more: make all interfacing
with the file server happen through puffs_msg_enqueue() and
puffs_msg_wait() instead of having a billion different routines.
Build the existing system upon these two. Most importantly though,
decouple insertation into the op queue from the actual wait. This
is useful for a number of reasons coming soon to a cvs repo near you.

Bounds-check responses from userspace.

Part 2/n of extensive changes to request transport to/from userspace:

Rip the transport code completely out of puffs and generalize it
into an independent module which will be used for multiple purposes
in the future. This module is called the Pass-to-Userspace
Transporter (known as "putter" among friends).

This is very much work-in-progress and one dependency with puffs
remains: the request framing format.

The device name is still /dev/puffs, but that will change soon.

Users of puffs need the following in their kernel configs now:
pseudo-device putter

branches: 1.59.2; 1.59.4;
Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

g/c more unused stuff

g/c vntouser_req(), it's not used anymore

g/c the "sizeop" code previous used for ioctl/fcntl. It was already
commented out and has bitrotted beyond all recognition, so it needs
complete rethinking.

If kernel resource allocation fails after the file server has
committed something, issue an abort. The abort is done through
the regular op channel, e.g. failed mkdir leads to regular rmdir,
inactive and reclaim. No internal interface is planned currently
for the one file system out of a million which would implement it
to benefit from the one case in a billion where kernel resource
allocation actually does fail and out of that one case in a trillion
where internal vs. external would make a difference.

* better error checking: validate error values received from userland
to be vaild errno values
* include string describing error in PUFFS_ERR
* get rid of union in puffs_req, it's nothing but trouble
* pass pmp to async i/o callbacks

Split routines handling nodes from puffs_subr to puffs_node.
No functional change.

Differentiate between cookie2vnode returning an error and
return to caller, address unknown: no such cookie, no such node.
Make the callers use this info to either create a new vnode or bail.

Add error notifications, which are used to deliver errors from the
kernel to the file server for silly things the file server did,
e.g. attempting to create a file with size VSIZENOTSET. The file
server can handle these as it chooses, but the default action is
for it to throw its hands in the air and sing "goodbye, cruel world,
it's over, walk on by".

Fix a race in how new cookies are checked. Previously the checking
was done separate of inserting the cookie into the lookup structure
and without any form of interlock. This could lead to the same
cookie pointing to two different nodes. Remedy the race by creating
a separate "checked and ready to be inserted" cookie list which
serves as an interlock without having to hold a fs-global creation
lock.

add a few comments and g/c dead code

branches: 1.48.4; 1.48.6; 1.48.8; 1.48.10;
Move PUFFS_TYPEPREFIX to puffs_msgif.h since it's used in a macro there.

Keep track of the maximum size we have supplied the file server (or
it has supplied us). If we fault pages which are at offset >= server
size, but less than the in-kernel vnode size, inform the file server
of the latest developments in file size before issueing the fault.
The avoids confusion with files which are not written start to finish.

fixes kern/36429 by yamt

branches: 1.46.2;
Set a file server supplied file system type in the type field and set
the mntfromname to be the place mounted from instead of the type.

Give the file server to ability to request the entire pathname buffer
under lookup by using PUFFS_KFLAG_LOOKUP_FULLPNBUF instead just the
current component.

Instead of supplying a plain pid, supply an abstract struct puffs_cid *,
which can currently be used to query the pid and lwpid.

make puffs_cred an opaque type

Split the NOCACHE option in twain: NOCACHE_NAME & NOCACHE_PAGE.

Refactor the pnode2vnode translation slightly so that VFS_ROOT
can use it directly.

Reorganize how the root vnode is fetched so that it doesn't always
go through VFS_ROOT() and allow to fetch it without locking it.
This allows us to call the cache flush operations also for the root
vnode and most notably fixes e.g. a "No such file or directory"
for a psshfs root directory ls -l when a file was locally deleted
and remotely re-created.

Also fix some sloppy programming in root node fetch (mostly cosmetic).

Move puffs to a two clause license where it already isn't so. And
as agc pointed out, even files with the third clause were already
effectively two clause because of a slight bug in the language...

forgot to commit this with puffs_vnops.c 1.72:

Actually, we do need separate "no references in file server" and
"noref + inactive" flags if we wish to correctly support unix open
file semantics and optimize away pre-reclaim cache flushes. So,
add PNODE_DYING which stands for norefs + inactive.

Introduce noref setbacks, which the file server can use to signal
the kernel it has 0 references to the node in question. In other
words, this can be used to avoid inactive(), or, if the file server
does not implement inactive, prompt reclaim for removed nodes.

Support VOP_POLL. This requires some acrobatics on the puffs_node,
as we give a reference to userspace for the puffs_node for the
duration of the poll call. So reference count puffs_node separately
from the parent vnode. vref()/vrele() is not possible due to a possible
surprise visit from VOP_INACTIVE.

Make it possible for the file server to specify the root vnode type
and other information instead of always using VDIR. To make this
possible without races, require all root node information already
in puffs_mount() and nuke puffs_start2() and the associated start
operation completely.

requested/inspired by Tobias Nygren

Introduce puffs "setbacks", which can be used to set certain flags
for nodes upon return from the userspace. Currently it can be used
to indicate that the file server should be notified of "inactive"
in case the file server has opted to not receive inactive every
time the reference count for a vnode drops to zero. (inactive is
a common event, almost never requires any action and must be executed
sychronously, so it is wasteful).

While doing this, cleanup the release-relock nonsense from the
vntouser*() arguments. It was never enabled and the whole LOCKEDVP()
concept was very broken to begin with.

Fix a problem introduced when I converted puffs to use newlock2:
when unmounting the file system in case of a certain timing (and
possibly some other conditions), a thread would wait on a condition
variable, while another thread broadcast the cv and immediately
proceeded to destroy it. The result was a system frozen completely
solid shorly after the process waiting for the cv woke up. So
introduce reference counting to synchronize destruction of the
resources in unmount.

I was able to repeat the problem only on my laptop in some special
cases, so I do not know how common it was. Ironically, killing
the file server process violently instead of unmount() didn't have
this problem because it never entered the unmount path from two
directions.

Give the file server the ability to specify the file handle length
instead of defining a static length file handle on the framework-level.

* add fhlen to kernel argument structure
* rename it to puffs_kargs instead of puffs_args

Make it possible to interrupt waiters for fs operation completion
again. This is useful until locking is further developed and basically
any deadlocks can be solved by killing appropriate processes.

Thanks especially to Tommi Kyntola and Antti Louko for sitting down
with me and discussing resource ownership and locking strategies
in implementing this.

* abstract ASYNCBIOREAD and let callers freely issue a callback called
from putop. even though there's only one user currently, makes code
more readable
* move "delta" to a standard parameter in vntouser and get rid of the
specialcase vntouser_delta

Convert spinlocks & sleep/wakeup to newlock2 locking stuff. Fix a
bunch of bugs.

* park structures are now always allocated from a pool instead of a
mixed stack/malloc allocation
* get rid of the whole adjbuf concept, always just alloc the maximal
amount of memory to satisfy a request
* little regression: don't allow interrupting wait from file system
to userspace; this had problems already before, but now the problems
really started to shine through. I'll try to make this work again
some day.
* fix bmap to return a sensible value in runp

* rework the page cache interaction a bit: cache metadata in the
kernel and flush it out all at once instead of continuous updating
* add support for delivering notifications to the file server about
when a page was written to (but disabled by default for now). the
file server can use this to request flushing or invalidating the
kernel page cache

branches: 1.26.2;
Support B_READ|B_ASYNC in strategy by calling biodone() directly
when the file server puts the result.

branches: 1.25.2; 1.25.4;
Make wait for the user file server PCATCHable. This makes it
possible to recover the system by just killing processes in case
a file server manages to recurse into itself either by fault of
file server implementation or by pilot error. The downside is that
the code is extremely hard to follow and practically screams out
for newlock2 (in addition to screaming "bug here"). The whole
PCATCH nonsense and induced megacomplexity can hopefully be avoided
in the future by tweaking other parts of the implementation.

branches: 1.24.2;
Hide the debug prints behind PUFFSDEBUG instead of DEBUG. Make the
latter define the former.

Remove more duplicate headers.
Patch by Slava Semushin <slava.semushin@gmail.com>

Again, this was tested by comparing obj files from a pristine and a patched
source tree against an i386/ALL kernel, and also for src/sbin/fsck_ffs,
src/sbin/fsdb and src/usr.sbin/makefs. Only changes in assert() line numbers
were detected in 'objdump -d' output.

Initial attempt at suspend/snapshot support for userspace file
servers. This is still pretty much on the level "if it breaks ...".
It should work for single-threaded servers which handle one operation
from start to finish in one go. Also, it does not yet totally
correctly synchronize metadata and data in some cases. So needless
to say, it needs improvement, but it is possible that will have to
wait for some lock revampage.

optimize a bit: don't flush pages for vnodes which have no references
in the kernel or links in the backend

Store puffs_node's on lists hashed with the cookie value instead
of just one flat list.

* do not accept the directory cookie as the result of a lookup (otherwise
we'd be locking against ourselves)
* do not accept duplicate cookies when creating new nodes

Introduce flush operations, which the fs server can use to control
kernel caching. Currently supported are only flushing the name
cache for a directory or flushing the name cache for the entire fs.

Also, get rid of PNODE_INACTIVE status, since it was racy and
essentially didn't work. All this on top of being useless in the
first place ....

* check userspace version and prevent incompatible mount
* some general maintenance

branches: 1.16.2;
* use PUFFS_KFLAG_NOCACHE to also signal that we don't want the namecache
* enter files into the namecache immediately when new nodes are created
(if it's a caching mount, of course)

rename the kernel-provided componentname to puffs_kcn; libpuffs now
provides puffs_cn built on top of it

Fix a race condition that would cause the mountpoint to be cleaned
from under someone waiting for the fs server response in puffs_unmount()
if the descriptor was closed during the response wait (such as bug
leading to a crash in fs implementation unmount()).

branches: 1.13.2;
shuffle functions around a bit: move the transport (/dev/puffs) to
a different file from the messaging (request contents). no functional
change

Allow multiple requests to be transferred in each GET/PUTOP. For
a single request, the performance is still the same.

prefix kernel flags with PUFFS_KFLAG to have a separate namespace
from the library flags

don't call the fs server for all operations, only those it has told
us that it implements

branches: 1.9.2;
As a first generation best-effort hack, use NOCACHE to mean "file
size can change without the kernel knowing" and therefore query
the file size before invoking read or write operations.

Introduce uncached operation, makes sense when the file system backend
can be modified from elsewhere than the file system interface

few renames to better differentiate between mount & start.. plus some
other renaming

attach to genfs & support page cache. most noticeable effect is
mmap and therefore execution of binaries starting to work, some
speed improvements with large file I/O also. caching semantics
and error case handling most likely need revisiting.

puffs_park always contains a specific puffs_req, so make it a member
instead of a pointer

make it possible to build & load puffs as an LKM

by Lubomir Kundrak, PR kern/35000

support fifos

support specfs

kernel portion of puffs - the Pass-to-Userspace Framework File System.
It contains the VFS attachment and userspace message-passing interface.

This work was initially started and completed for Google SoC 2005
and tweaked to work a bit better in the past few weeks. While
being far from complete, it is functional enough to be able and
stable to host a fairly general-purpose in-memory file system in
userspace. Even so, puffs should be considered experimental and
no binary compatibility for interfaces or crash-freedom or zero
security implications should be relied upon just yet.

The GSoC project was mentored by William Studenmund and the final
review for the code was done by Christos.

Part 2/n of extensive changes to request transport to/from userspace:

Rip the transport code completely out of puffs and generalize it
into an independent module which will be used for multiple purposes
in the future. This module is called the Pass-to-Userspace
Transporter (known as "putter" among friends).

This is very much work-in-progress and one dependency with puffs
remains: the request framing format.

The device name is still /dev/puffs, but that will change soon.

Users of puffs need the following in their kernel configs now:
pseudo-device putter

branches: 1.27.2; 1.27.4;
Handle suspend and flush requests from the file server.

Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

g/c the "sizeop" code previous used for ioctl/fcntl. It was already
commented out and has bitrotted beyond all recognition, so it needs
complete rethinking.

Differentiate between cookie2vnode returning an error and
return to caller, address unknown: no such cookie, no such node.
Make the callers use this info to either create a new vnode or bail.

Fix a race in how new cookies are checked. Previously the checking
was done separate of inserting the cookie into the lookup structure
and without any form of interlock. This could lead to the same
cookie pointing to two different nodes. Remedy the race by creating
a separate "checked and ready to be inserted" cookie list which
serves as an interlock without having to hold a fs-global creation
lock.

branches: 1.22.4; 1.22.6; 1.22.8; 1.22.10;
define PUFFSREQSIZEOP ioctl, which can be used to fetch the
maximum request size

branches: 1.21.2;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Refactor the pnode2vnode translation slightly so that VFS_ROOT
can use it directly.

Move puffs to a two clause license where it already isn't so. And
as agc pointed out, even files with the third clause were already
effectively two clause because of a slight bug in the language...

Make it possible for the file server to specify the root vnode type
and other information instead of always using VDIR. To make this
possible without races, require all root node information already
in puffs_mount() and nuke puffs_start2() and the associated start
operation completely.

requested/inspired by Tobias Nygren

Fix a problem introduced when I converted puffs to use newlock2:
when unmounting the file system in case of a certain timing (and
possibly some other conditions), a thread would wait on a condition
variable, while another thread broadcast the cv and immediately
proceeded to destroy it. The result was a system frozen completely
solid shorly after the process waiting for the cv woke up. So
introduce reference counting to synchronize destruction of the
resources in unmount.

I was able to repeat the problem only on my laptop in some special
cases, so I do not know how common it was. Ironically, killing
the file server process violently instead of unmount() didn't have
this problem because it never entered the unmount path from two
directions.

fix comment in previous

Allow to set non-blocking mode for transport fd even if the file
system is not yet mounted.

support flushing pagecache

actually, we don't need a separate op for flushing the whole page cache
of a node, just use the range op with endoff = 0

* enable PUFFS_INVAL_PAGECACHE_NODE_RANGE
* add input parameter validation

g/c some commented ltsleep calls accidentally left from newlock2 adaptation

Convert spinlocks & sleep/wakeup to newlock2 locking stuff. Fix a
bunch of bugs.

* park structures are now always allocated from a pool instead of a
mixed stack/malloc allocation
* get rid of the whole adjbuf concept, always just alloc the maximal
amount of memory to satisfy a request
* little regression: don't allow interrupting wait from file system
to userspace; this had problems already before, but now the problems
really started to shine through. I'll try to make this work again
some day.
* fix bmap to return a sensible value in runp

* rework the page cache interaction a bit: cache metadata in the
kernel and flush it out all at once instead of continuous updating
* add support for delivering notifications to the file server about
when a page was written to (but disabled by default for now). the
file server can use this to request flushing or invalidating the
kernel page cache

branches: 1.8.2; 1.8.6; 1.8.8; 1.8.10;
Make fstrans(9) the default helper for file system suspension.
Replaces the now obsolete vn_start_write()/vn_finished_write().

Merge newlock2 to head.

don't need pi_lock for struct member access, so don't take it

Initial attempt at suspend/snapshot support for userspace file
servers. This is still pretty much on the level "if it breaks ...".
It should work for single-threaded servers which handle one operation
from start to finish in one go. Also, it does not yet totally
correctly synchronize metadata and data in some cases. So needless
to say, it needs improvement, but it is possible that will have to
wait for some lock revampage.

branches: 1.4.2;
Introduce flush operations, which the fs server can use to control
kernel caching. Currently supported are only flushing the name
cache for a directory or flushing the name cache for the entire fs.

Also, get rid of PNODE_INACTIVE status, since it was racy and
essentially didn't work. All this on top of being useless in the
first place ....

branches: 1.3.2;
* free puffs_instance structure in all cases when closing the descriptor
* comment, rcsid & kassert police

Fix a race condition that would cause the mountpoint to be cleaned
from under someone waiting for the fs server response in puffs_unmount()
if the descriptor was closed during the response wait (such as bug
leading to a crash in fs implementation unmount()).

branches: 1.1.2;
shuffle functions around a bit: move the transport (/dev/puffs) to
a different file from the messaging (request contents). no functional
change

Put a copy of our existing data first in the non-error case (noticed by RVP).

branches: 1.125.6; 1.125.8;
Tighten up the locking around vp->v_iflag a little more after the recent
split of vmobjlock & v_interlock.

VFS_VGET(), VFS_ROOT(), VFS_FHTOVP(): give them a "int lktype" argument, to
allow us to get shared locks (or no lock) on the returned vnode. Matches
FreeBSD.

branches: 1.123.2;
Fix copying issue that was causing errors in unit_test puffs_tstavfs by
removing code.

Restore binary compatibility by using the statvfs90 structure internally.

branches: 1.121.2;
add a genfs method to allow a file system to limit the range of pages
that are given to a single GOP_WRITE() call. needed by ZFS.

branches: 1.120.12;
KASSERT(mutex_owned(vp->v_interlock)) in vnode iterator selector.

Add generic genfs_suspendctl() and use it for all file systems.
Layered file systems need work.

branches: 1.118.2; 1.118.4;
PR/50573: Andreas Gustafsson: puffs can crash kernel for lack of argument
checking

Remove debug printf

Add PUFFS_KFLAG_NOFLUSH_META to prevent sending metadata flush to FUSE

FUSE filesystems do not expect to get metadata updates for [amc]time
and size, they updates the value on their own after operations.

The PUFFS PUFFS_KFLAG_NOFLUSH_META option prevents regular metadata cache
flushes to the filesystem , and libperfuse uses it to match Linux FUSE
behavior.

While there, fix a bug in SETATTR: do not update kernel metadata cache
from SETATTR reply when the request is asynchronous, as we do not have
the reply yet.

branches: 1.115.2;
Do not uselessly include <sys/malloc.h>.

Change puffs from hashlist to vcache.
- field "pa_nhashbuckets" of struct "puffs_kargs" becomes a no-op.
and should be removed on the next protocol version bump.

branches: 1.113.2;
use standard dirty vnode test.

The pageflush_selector gets a vnode with v_interlock held.
Remove the mutex_enter()/mutex_exit() and simplify.

Hi christos...

Introduce a selector function to the vfs vnode iterator so that we don't
need to vget() vnodes that we are not interested at, and optimize locking
a bit. Iterator changes reviewed by Hannken (thanks), the rest of the bugs
are mine.

An (un)privileged user can easily make the kernel dereference a NULL
pointer.

The kernel allows 'data' to be NULL; it's the fs's responsibility to
ensure that it isn't NULL (if the fs actually needs data).

ok christos@

branches: 1.109.2;
Change all vfsops to use C99 designated initializers.

No functional changes intended.

Change pageflush() to use vfs_vnode_iterator.

branches: 1.107.2;
Do the protocol consistency check hack only when compiling ELF.

branches: 1.106.2;
Backout previous bugfix attempt for unmounts. That changes did not
address the real problem.

Rename slow sopreq queue into node sopreq queue, to refet the fact that
is only intended for postponed node reclaims.
When purging the node sopreq queue, do not call puffs_msg_sendresp(), as
it makes no sense.

puffs mounts share global pools. This means that the puffs_vfsops cannot
be vfs_detach'ed by module autounload before puffs_vfsop_unmount() completes
and has freed ressource from the pools. By holding a reference on
puffs_vfsops from each mount, we ensure that no race can occur here.

Works around the crash in kern/46734

Fix hang unmount bug introduced by last commit.

We introduced a slow queue for delayed reclaims, while the existing
queue for unmount, flush and exist has been renamed fast queue. Both
queues had timestamp for when an operation should be done, but it was
useless for the fast queue, which is always used to run an operation
ASAP. And the timestamp test had an error that turned ASAP into "at next
tick", but nobody what there to wake the thread at next tick, hence
the hang. The fix is to remove the useless and buggy timestamp test for
fast queue.

- Improve PUFFS_KFLAG_CACHE_FS_TTL by reclaiming older inactive nodes.

The normal kernel behavior is to retain inactive nodes in the freelist
until it runs out of vnodes. This has some merit for local filesystems,
where the cost of an allocation is about the same as the cost of a
lookup. But that situation is not true for distributed filesystems.
On the other hand, keeping inactive nodes for a long time hold memory
in the file server process, and when the kernel runs out of vnodes, it
produce reclaim avalanches that increase lattency for other operations.

We do not reclaim inactive vnodes immediatly either, as they may be
looked up again shortly. Instead we introduce a grace time and we
reclaim nodes that have been inactive beyond the grace time.

- Fix lookup/reclaim race condition.

The above improvement undercovered a race condition between lookup and
reclaim. If we reclaimed a vnode associated with a userland cookie while
a lookup returning that same cookiewas inprogress, then the kernel ends
up with a vnode associated with a cookie that has been reclaimed in
userland. Next operation on the cookie will crash (or at least confuse)
the filesystem.

We fix this by introducing a lookup count in kernel and userland. On
reclaim, the kernel sends the count, which enable userland to detect
situation where it initiated a lookup that is not completed in kernel.
In such a situation, the reclaim must be ignored, as the node is about
to be looked up again.

Add name and atttribute cache with filesytem provided TTL.
lookup, create, mknod, mkdir, symlink, getattr and setattr messages
have been extended so that attributes and their TTL can be provided
by the filesytem. lookup, create, mknod, mkdir, and symlink messages
are also extended so that the filesystem can provide name TTL.

branches: 1.100.2; 1.100.6; 1.100.8;
Remove #ifdef DIAGNOSTIC guards around KASSERT, as the macro contains them

Make sure pagedaemon does not sleep for memory in puffs_vnop_sleep.
Add KASSERT on any sleeping memory allocation to check it cannot happen again.

As vnalloc() always allocates with PR_WAITOK there is no longer the need
to test its result for NULL.

Make sure ioflush does not sleep in PUFFS code path, waiting for a mutex,
a memory allocation, or a response from the filesystem.

This avoids deadlocks in the following situations:
1) when memory is low: ioflush waits the fileystem, the fielsystem waits
for memory
2) when the filesystem does not respond (e.g.: network outage ona
distributed filesystem)

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.95.6;
Make holding v_interlock mandatory for callers of vget().

Announced some time ago on tech-kern.

f_namemax is one of the static fields overridden by copy_statvfs_info(),
so be sure to set it to the value coming from the file server as
part of mount args.

exposed, like so many other problems, by njoly's tests

Add compat to enable running puffs in a 64bit time_t kernel against
a server which runs in 32bit time_t namespace.

ctassert size of some key structures does not change

Make sure that pa_spare is zero-filled and does not contain any
garbage which might disrupt future use.

Clean up vnode lock operations pass 2:

VOP_UNLOCK(vp, flags) -> VOP_UNLOCK(vp): Remove the unneeded flags argument.

Welcome to 5.99.32.

Discussed on tech-kern.

Since libpuffs needs a major bump for extattr support anyway, make
some changes to the user-kernel protocol. Namely, try to be a
little more resilient some future changes.

Support extended attributes.

branches: 1.87.2;
* add a rant about why MPSAFE isn't enabled even though puffs code is
* predict_false that we are mounting when calling statvfs
* KNF

branches: 1.86.2;
In case the operations thread has exited, do not queue any more
operations. This prevents kernel memory leaks (one of which happened
every time the file system was unmounted via PUFFSOP_UNMOUNT ...
and incidentally would've been trivially caught with the old
malloc(9) interface. I wonder if the message is to use a ton of
pools instead of regression-attractive kmem interface).

Rename PUFFS_SOPREQ_EXIT to PUFFS_SOPREQSYS_EXIT to better signal
it comes from within the kernel instead of as a direct result of
a user request.

no functional change

Process flush requests from the file server in a separate thread
context. This fixes a long-standing but seldomly seen deadlock,
where the kernel was holding pages busy (due to e.g. readahead
request) while waiting for the server to respond, and the server
made a callback into the kernel asking to invalidate those pages.
... or, well, theoretically fixes, since I didn't have any reliable
way of repeating the deadlock and I think I saw it only twice.

Kill suspend support. It was never implemented correctly:
* it depended on the biglock (in a very cruel way)
* it was attached to userspace transactions rather than logical
fs operations

(If someone wants to revisit it some day, most of the stuff can be
reused from cvs history)

Ansify function definitions w/o arguments. Generated with sed.

branches: 1.81.6; 1.81.8; 1.81.12; 1.81.16;
Add module dependency on putter.

Convert file systems to dynamically attach with the new module interface.
Make VFS hooks dynamic while we're here and say farewell to VFS_ATTACH and
VFS_HOOKS_ATTACH linksets.

As a consequence, most of the file systems can now be loaded as new style
modules.

Quick sanity check by ad@.

branches: 1.79.2;
PR kern/38057 ffs makes assuptions about devvp file system
PR kern/33406 softdeps get stuck in endless loop

Introduce VFS_FSYNC() and call it when syncing a block device, if it
has a mounted file system.

branches: 1.78.6; 1.78.8; 1.78.10;
Fix some race conditions in rename.
Introduce a per-FS rename lock and new vfsops to manipulate it.
Get this lock while renaming. Also add another relookup() in do_sys_rename,
which is a hack to kludge around some of the worst deficiencies of
ufs_rename.
reviewed-by: pooka (and an earlier rev by ad)
posted on tech-kern with no objections.

fix vmlocking2 fallout: fstrans_mount/unmount

valloc -> vnalloc, vfree -> vnfree
Avoids collision with userland valloc(3).

no functional change
ad ok

More type-punning workarounds. Curiously the kernel compilation
flags cause gcc to not complain.

Merge vmlocking2 to head.

namespace a bit: vfsops -> puffs_vfsop_x() and vops -> puffs_vnop_x()

branches: 1.72.2; 1.72.6;
Remove "puffs_cid" from the puffs interface following l-removal
from the kernel vfs interfaces. puffs_cc_getcaller(pcc) can be
used now should the same information be desired.

Remove the "struct lwp *" argument from all VFS and VOP interfaces.
The general trend is to remove it from all kernel interfaces and
this is a start. In case the calling lwp is desired, curlwp should
be used.

quick consensus on tech-kern

Retire M_PUFFS, use kmem(9) instead.

Restructure the messaging interface a bit more: make all interfacing
with the file server happen through puffs_msg_enqueue() and
puffs_msg_wait() instead of having a billion different routines.
Build the existing system upon these two. Most importantly though,
decouple insertation into the op queue from the actual wait. This
is useful for a number of reasons coming soon to a cvs repo near you.

* split the putter header into a kernel version and a userland version
+ install latter to /usr/include/dev/putter
* remove last dependencies to puffs from putter, it's completely
independent now

Move putter code from directly under dev/ to dev/putter/

no functional change

Part 2/n of extensive changes to request transport to/from userspace:

Rip the transport code completely out of puffs and generalize it
into an independent module which will be used for multiple purposes
in the future. This module is called the Pass-to-Userspace
Transporter (known as "putter" among friends).

This is very much work-in-progress and one dependency with puffs
remains: the request framing format.

The device name is still /dev/puffs, but that will change soon.

Users of puffs need the following in their kernel configs now:
pseudo-device putter

branches: 1.65.2; 1.65.4;
Handle suspend and flush requests from the file server.

in case of version mismatch, print the numbers

Part 1/n of some pretty extensive changes to how the kernel module
interacts with the userspace file server:

* since the kernel-user communication is not purely request-response
anymore (hasn't been since 2006), try to rename some "request" to
"message". more similar mangling will take place in the future.

* completely rework how messages are allocated. previously most of
them were borrowed from the stack (originally *all* of them),
but now always allocate dynamically. this makes the structure
of the code much cleaner. also makes it possible to fix a
locking order violation. it enables plenty of future enhancements.

* start generalizing the transport interface to be independent of puffs

* move transport interface to read/write instead of ioctl. the
old one had legacy design problems, and besides, ioctl's suck.
implement a very generic version for now; this will be
worked on later hopefully some day reaching "highly optimized".

* implement libpuffs support behind existing library request
interfaces. this will change eventually (I hate those interfaces)

Cache vnode member variables necessary for operations after the
userspace call, namely our private mount structure, in the activation
record. This avoids problems in situations where the userspace
file server happens to die during our upcall and the vnode is
forcibly reclaimed before we roll back to the current stack frame.

g/c more unused stuff

* better error checking: validate error values received from userland
to be vaild errno values
* include string describing error in PUFFS_ERR
* get rid of union in puffs_req, it's nothing but trouble
* pass pmp to async i/o callbacks

Differentiate between cookie2vnode returning an error and
return to caller, address unknown: no such cookie, no such node.
Make the callers use this info to either create a new vnode or bail.

Add error notifications, which are used to deliver errors from the
kernel to the file server for silly things the file server did,
e.g. attempting to create a file with size VSIZENOTSET. The file
server can handle these as it chooses, but the default action is
for it to throw its hands in the air and sing "goodbye, cruel world,
it's over, walk on by".

Fix a race in how new cookies are checked. Previously the checking
was done separate of inserting the cookie into the lookup structure
and without any form of interlock. This could lead to the same
cookie pointing to two different nodes. Remedy the race by creating
a separate "checked and ready to be inserted" cookie list which
serves as an interlock without having to hold a fs-global creation
lock.

branches: 1.56.2;
move static KASSERT from mount to init

* don't allow the file server to specify a node size to be VSIZENOTSET
* KASSERT that VNOVAL == VSIZENOTSET

branches: 1.54.2;
Add a third type of fh option, passthrough, where the kernel does
not attempt to handle struct fid at all and passes it as such to
userspace.

branches: 1.53.2; 1.53.4;
* nuke the nameidata parameter from VFS_MOUNT(). Nobody on tech-kern
knew what it was supposed to be used for and wrstuden gave a go-ahead
* while rototilling, convert file systems which went easily to
use VFS_PROTOS() instead of manually prototyping the methods

Make the minimum request size twice the minimum request structure size.
Otherwise ops with payload would have no room for payload.

branches: 1.51.2;
Set a file server supplied file system type in the type field and set
the mntfromname to be the place mounted from instead of the type.

Make set_statvfs_info() take a parameter for the vfs name instead
of always retrieving it from mp->mnt_op->vfs_name

christos ok

Remove the copyout() of the mount args from puffs_mount(), the buffer
supplied is a kernel address.
The puffs userspace code has been changed to do a 2nd call with
MNT_GETARGS to retrieve the information.

Change the VFS_MOUNT() interface so that the 'data' buffer passed to the
fs code is a kernel buffer, pass though the length of the buffer as well.
Since the length of the userspace buffer isn'it (yet) passed through the mount
system call, add a field to the vfsops structure containing the default length.
Split sys_mount() for calls from compat code.
Ride one of the recent kernel version changes - old fs LKMs will load, but
sys_mount() will reject any attempt to use them.

Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

Instead of supplying a plain pid, supply an abstract struct puffs_cid *,
which can currently be used to query the pid and lwpid.

Refactor the pnode2vnode translation slightly so that VFS_ROOT
can use it directly.

Reorganize how the root vnode is fetched so that it doesn't always
go through VFS_ROOT() and allow to fetch it without locking it.
This allows us to call the cache flush operations also for the root
vnode and most notably fixes e.g. a "No such file or directory"
for a psshfs root directory ls -l when a file was locally deleted
and remotely re-created.

Also fix some sloppy programming in root node fetch (mostly cosmetic).

Move puffs to a two clause license where it already isn't so. And
as agc pointed out, even files with the third clause were already
effectively two clause because of a slight bug in the language...

Make it possible for the file server to specify the root vnode type
and other information instead of always using VDIR. To make this
possible without races, require all root node information already
in puffs_mount() and nuke puffs_start2() and the associated start
operation completely.

requested/inspired by Tobias Nygren