git.openafs.org Git - openafs.git/log

ubik: update epoch as soon as sync-site is elected

The ubik_epochTime represents the time at which the coordinator first
received its coordinator mandate. However, this global is currently not
updated at the moment when a new sync-site is elected. Instead,
ubik_epochTime is only updated at the very end of the first write
transaction, when a new database label is written (in udisk_commit).
This causes at least 2 different issues:

For one, this means that we change ubik_epochTime while a remote
transaction is in progress. If VOTE_Beacon is called after
ubik_epochTime is updated, but before the remote transaction ends, the
remote sites will detect that the transaction id in ubik_currentTrans is
wrong (via urecovery_CheckTid(), since the epoch doesn't match), and
they will abort the transaction. This means the transaction will fail,
and it may cause a loss of quorum until another election is completed.

Another issue is that ubik_epochTime can be 0 at the beginning of a
write transaction, if this is the first election that this site has won.
Since ubik_epochTime is used to construct transaction ids, this means
that we can have different transactions that originate from different
sites at different times, but they have the same epoch in their tid.
For example, say a write transaction starts with epoch 0, but the
originating site is killed/interrupted before finishing. That write
transaction will linger on remote sites in ubik_currentTrans with an
epoch of 0 (since the originating site will never call
DISK_ReleaseLocks, or DISK_Abort, etc). Normally the sync site will kill
such a lingering transaction via urecovery_CheckTid, but since the epoch
is 0, and the election winner's epoch is also 0, the transaction looks
valid and may never be killed. If that transaction is holding a lock on
the database, this means that the database will forever remain locked,
effectively preventing any access to the db on that site.

To fix both of these issues, update ubik_epochTime with the current
time as soon as we win the election. This ensures that the epoch is not
updated in the middle of a transaction, and it ensures that all
transactions are created with a unique epoch: the epoch of the election
that we won.

Note that with this commit, we do not ever set ubik_epochTime to the
magic value of '2' during database init. The special '2' epoch only
needs to be set in the database itself, and it is never an actual epoch
that represents a real quorum that went through the election process.
The database will be labelled with a 'real' epoch after the first write,
like normal.

[kaduk@mit.edu: comment the locking strategy in ubeacon_Interact()]

Change-Id: I6cdcf5a73c1ea564622bfc8ab7024d9901af4bc8
Reviewed-on: https://gerrit.openafs.org/12609
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Marcio Brito Barbosa <mbarbosa@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

LINUX: afs_create infinite fetchStatus loop

For a file in a directory with the CStatd bit cleared, we can get
an infinite fetchStatus loop.

In afs_create(), afs_getDCache() may return NULL due to an error.
If unchecked it will loop which may produce multiple fetchStatus()
calls to the fileserver.

Credit: Yadav Yadavendra for identifying and analysing this issue.

Change-Id: Iecd77d49a5f3e8bb629396c57246736b39aa935f
Reviewed-on: https://gerrit.openafs.org/12651
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Update NEWS for volume stats default change

Change-Id: I1a184bf638609866f6f7f1d11c224dfee1113eef
Reviewed-on: https://gerrit.openafs.org/12678
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

volser: preserve volume stats by default

Commit dfceff1d3a66e76246537738720f411330808d64 added the
-preserve-vol-stats flag to the volume server. This enabled a change in
the volume server to preserve volume usage statistics during reclone and
restore operations. Otherwise, volume usage counters of read-only
volumes are cleared when volumes are released, making it difficult to
track usage with the volume stats.

Make this feature the default behavior of the volume server and provide
the option -clear-vol-stats to use the old behavior if so desired. This
change makes the -preserve-vol-stats the default, and keeps it as a
hidden flag for sites which may already have that flag set in the
BosConfig.

Since this changes a default behavior of the volume server, this change
is only appropriate on a major or minor release boundary, not in the
middle of a stable series.

Change-Id: I3706ede64b7b18a80b39ebd55f2e1824bb7dbc57
Reviewed-on: https://gerrit.openafs.org/12674
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

ubik: avoid early DISK_Begin calls we know will fail

Currently, we can start a write transaction on a site immediately after
it is elected as the sync site. However, after commit d47beca1,
SDISK_Begin on remote sites will fail right after an election occurs
(since lastYesState is not set, and so urecovery_AllBetter will fail).
And after commit fac0b742, this error is always noticed and propagated
back to the application.

As a result, when we try to write immediately after a sync site is
elected, the transaction will fail with UNOQUORUM, the remote sites will
be marked as down, and we may lose quorum and require another election
to be performed. This can easily happen repeatedly for a site that
frequently tries to make changes to a ubik database.

To avoid marking other sites down and going through another election
process, do not allow write transactions until we know that lastYesState
is set on the remote sites. We do this by waiting until the next wave of
beacons are sent, which tell the remote sites that we are the sync site.
In other words, only allow write transactions after the sync site knows
that the remote sites also know that the sync site has been elected.

With this commit, a write transaction immediately after an election
will still fail with UNOQUORUM, but we avoid triggering an error on the
remote sites, and avoid losing quorum in this situation.

Change-Id: I9e1a76b4022e6d734af1165d94c12e90af04974d
Reviewed-on: https://gerrit.openafs.org/12592
Reviewed-by: Andrew Deason <adeason@dson.org>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

ubik: allow remote dbase relabel if up to date

When a site is elected the sync-site, its database is not immediately
relabeled. The database in question will be relabeled at the end of the
first write transaction (in udisk_commit). To do so, the dbase->version
is updated on the sync-site first (1) and then the versions of the
remote sites are updated through SDISK_SetVersion() (2).

In order to make sure that the remote site holds the same database as
the sync-site, the SDISK_SetVersion() function checks if the current
version held by the remote site (ubik_dbVersion) is equal to the
original version stored by the sync-site (oldversionp). If
ubik_dbVersion is not equal to oldversionp, SDISK_SetVersion() will
fail with USYNC.

However, ubik_dbVersion can be updated by the vote thread at any time.
That is, if the sync site calls VOTE_Beacon() on the remote site between
events (1) and (2), the remote site will set ubik_dbVersion to the new
version, while ubik_dbase->version is still set to the old version. As
a result, ubik_dbVersion will not be equal to oldversionp and
SDISK_SetVersion() will fail with USYNC. This failure may cause a loss
of quorum until another election is completed.

To fix this problem, let SDISK_SetVersion() relabel the database when
ubik_dbase->version is equal to oldversionp. In order to try to only
affect the scenario described above, also check if ubik_dbVersion is
equal to newversionp.

Change-Id: I97e6f8cacd1c9bca0b4c72374c058c5fe5b638b3
Reviewed-on: https://gerrit.openafs.org/12613
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: fix repeated BulkStatus calls for directories.

There is a filetype comparison check in afs_DoBulkStat just after
BulkFetch RPC. This check will fail for directories even though
bulkStatus was done for directories.

This code is apparently necessary for Darwin, but it causes this problem
otherwise. Thus it is removed from the rest of the builds using the
AFS_DARWIN_ENV preprocessor variable.

Credit: Yadav Yadavendra for identifying and analysing this issue.

Change-Id: I9645f0e7a3327cb5f20cdf3ba2bf1cc5b1509bb5
Reviewed-on: https://gerrit.openafs.org/12610
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

relocate old afs docs to doc/txt

Move the afs/DOC files to the top-leve doc/txt directory, since this has
become the home for developer oriented documentation.

Change-Id: I128d338c69534b4ee6043105a7cfd390b280afe3
Reviewed-on: https://gerrit.openafs.org/12662
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Incorporate old release notes into NEWS

Cleanup the doc/txt directory by incorporating the old release
notes into the NEWS file.

Change-Id: I63911fc5cb0b476e201148c6d3fa3441f4746ab7
Reviewed-on: https://gerrit.openafs.org/12661
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Update NEWS for 1.8.0pre2

Change-Id: I5f83e81f25177bde1ea691e756359563e80ee3f2
Reviewed-on: https://gerrit.openafs.org/12660
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Import NEWS from openafs-stable-1_6_x

Import change descriptions for 1.6.20.1, 1.6.20.2, 1.6.21.

Change-Id: Ib4f06c7046eb6e1bb0a1ccfb9f6c45191154fe0e
Reviewed-on: https://gerrit.openafs.org/12659
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Linux: fix whitespace in osi_sysctl.c

Remove dozens of trailing spaces and make consistent use of tabs
for indentation throughout the file.

Change-Id: Ibbd17d2b9828590ffd84b76aac70646e9fe9cb2c
Reviewed-on: https://gerrit.openafs.org/12665
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

LINUX: Workaround d_splice_alias/d_lookup race

Before Linux kernel commit 4919c5e45a91b5db5a41695fe0357fbdff0d5767,
d_splice_alias in some cases can d_rehash the given dentry without
attaching it to the given inode, right before the dentry is unhashed
again. This means that for a few moments, that negative dentry is
visible to __d_lookup, and thus is visible to path lookup and can be
given to afs_linux_dentry_revalidate.

Currently, afs_linux_dentry_revalidate will say that the dentry is
valid, because d_time and other fields are set; it's just not attached
to an inode. This causes an ENOENT error on lookup, even though the
file is there (and no OpenAFS code said otherwise).

Normally this race is rare, but it can be frequently exercised if
we access the same directory via different names at the same time.
This can happen with multiple mountpoints to the same volume, or by
accessing an @sys directory via its abbreviated and expanded forms.

To get around this, make afs_linux_dentry_revalidate check negative
'dentry's to see if they are unhashed. We also lock the parent inode,
in order to guarantee that a problematic d_splice_alias call isn't
running at the same time (and thus, we know the dentry will not be
unhashed immediately afterwards). This slows down
afs_linux_dentry_revalidate for valid negative 'dentry's a little, but
it allows us to use negative dentry's at all.

Linux kernel commit 4919c5e45a91b5db5a41695fe0357fbdff0d5767 fixes
this issue, which was included in 2.6.34, so don't do this workaround
for 2.6.34 and on.

Change-Id: I8e58ebed4441151832054b1ef3f1aa5af1c4a9b5
Reviewed-on: https://gerrit.openafs.org/12638
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Linux 4.13: use designated initializers where required

struct path is declared with the "designated_init" attribute,
and module builds now use -Werror=designated-init. Cope.

And as pointed out by Michael Meffie, struct ctl_table has
the same requirement now, so use a designated initializer
for the final element of the sysctl table too.

Change-Id: I0ec45aac961dcefa0856a15ee218085626a357c7
Reviewed-on: https://gerrit.openafs.org/12663
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

afs: fix afs_xserver deadlock in afsdb refresh

When setting up a new volume, the cache manager calls afs_GetServer() to
setup the server object for each fileserver associated with the volume.
The afs_GetServer() function locks afs_xserver and then, among other
things, calls afs_GetCell() to lookup the cell info by cell number.

When the cache manager is running in afsdb mode, afs_GetCell() will
attempt to refresh the cell info if the time-to-live has been exceeded
since the last call to afs_GetCell(). During this refresh the AFSDB
calls afs_GetServer() to update the vlserver information. The afsdb
handler thread and the thread processing the volume setup become
deadlocked since the afs_xserver lock is already held at this point.

This bug will manifest when the DNS SRV record TTL is smaller than the
time the fileservers respond to the GetCapabilities RPC within
afs_GetServer() and there are multiple read-only servers for a volume.

Avoid the deadlock by using the afs_GetCellStale() variant within
afs_GetServer(). This variant returns the memory resident cell info
without the afsdb upcall and the subsequent afs_GetServer() call.

Change-Id: Iad57870f84c5e542a5ee20f00ea03b3fc87683a1
Reviewed-on: https://gerrit.openafs.org/12652
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: restore force_if_down check when getting connections

Commit cb9e029255420608308127b0609179a46d9983ad removed the
force_if_down check in afs_ConnBySA, which effictively turned on
force_if_down flag for every call to afs_ConnBySA. This caused
afs_ConnBySA to always return connections, even for server addresses
marked down and force_if_down set to 0.

One serious consequence of this bug is the cache manager will retry the
preferred vlserver indefinitely when it is unreachable. This is because
the loop in afs_ConnMHosts always tries hosts in preferred order and
expects afs_ConnBySA to return a NULL if the server address has no
connections because it is marked down.

Restore the check for server addresses marked down to honor the
force_if_down flag again so we do not get connections for down servers
unless requested.

Change-Id: Ia117354929a62b0cedc218040649e9e0b8d8ed23
Reviewed-on: https://gerrit.openafs.org/12653
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

redhat: fix rpmbuild command line option defaults

Fix the handling of default values for the various rpmbuild options
which can be given. These have been broken as code was shuffled around
over the years.

Remove obsolete comments about detecting what to build based on the
architecture.

Provide the '--without authlibs' option to disable the openafs-authlibs
package.

Change-Id: I6c8db1f3163ee241f9a4d1282345a0ddeabd284c
Reviewed-on: https://gerrit.openafs.org/12596
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

mkvers: fix potential buffer overflow

The space allocated for outputFileBuf is only 2 bytes larger than
sizeof(VERS_FILE). But we add potentially 4 extra bytes like
".txt" or ".xml". Just allocate enough space for all file suffices.

Change-Id: Ic0f97590be208deaf9c4a5c25e21056ea9d2cd6f
Reviewed-on: https://gerrit.openafs.org/12657
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs_linux_lookup: Avoid d_add on afs_lookup error

Currently, afs_linux_lookup looks roughly like this pseudocode:

{
    code = afs_lookup(&vcp);
    if (!code) {
        ip = AFSTOV(vcp);
        error = process_ip(ip);
        if (error) {
            goto done;
        }
    }
    process_dp(dp);
    newdp = d_splice_alias(ip, dp);
done:
    cleanup();
}

Note that if there is an error while processing the looked-up inode
(ip), we jump over d_splice_alias. But if we encounter an error from
afs_lookup itself, we do not jump over d_splice_alias. This means that
if afs_lookup encounters any error, we initialize the given dentry
(dp) as a negative entry, effectively telling the Linux kernel that
the requested name does not exist.

This is correct for ENOENT errors, of course, but is incorrect for any
other error. For non-ENOENT errors we later return an error from the
function, but this does not invalidate the generated dentry. The
result is that when afs_lookup encounters an error, that error will be
propagated to userspace, but subsequent lookups for the same name will
yield an ENOENT error (until the dentry is invalidated). This can
easily cause a file to seem to mysteriously disappear, if a transient
error like network problems caused the afs_lookup call to fail.

To fix this, treat ENOENT as a non-error, like the comments already
suggest. In our case, ENOENT is not really an error; it just means we
populate the given dentry differently. So if we get ENOENT from
afs_lookup, set our vcache to NULL and clear the error, and continue.

This also has the side effect of not treating ENOENT errors from
afs_CreateAttr identically to ENOENT errors from afs_lookup. That
shouldn't happen, but there have been abuses of the ENOENT error code
in the past, so it is probably better to be cautious.

Many thanks to Gaja Sophie Peters for assistance in tracking down and
testing fixes for this issue, including providing access to test systems
experiencing the buggy behavior.

FIXES 133654

Change-Id: Ia9aab289d5c041557ab6b00f1d41de2edfc97a89
Reviewed-on: https://gerrit.openafs.org/12637
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Joe Gorse <jhgorse@gmail.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>

LINUX: Rearrange afs_linux_lookup cleanup

Currently, the cleanup and error handling in afs_linux_lookup is
structured similar to this pseudocode:

    if (!code) {
        if (!IS_ERR(newdp)) {
            return no_error;
        } else {
            return newdp_error;
        }
    } else {
        return code_error;
    }

The multiple different nested error cases make this a little complex.
To make this easier to follow for subsequent changes, alter this
structure to be more like this:

    if (IS_ERR(newdp)) {
        return newdp_error;
    }

    if (code) {
        return code_error;
    }

    return no_error;

There should be no functional change in this commit; it is just code
reorganization.

Technically the ordering of these checks is changed, but there is no
combination of conditions that actually results in different code
being hit. That is, if 'code' is nonzero and IS_ERR(newdp) is true,
then we would go through a different path. But that cannot happen,
since if 'code' is nonzero, we have no inode and so IS_ERR(newdp)
cannot be true (d_splice_alias cannot return an error for a NULL
inode). So there is no functional change.

Change-Id: I94a3aef5239358c3d13fe5314044dcc85914d0a4
Reviewed-on: https://gerrit.openafs.org/12636
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Joe Gorse <jhgorse@gmail.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>

doc: Add introduction and credits to ubik.txt

Credit where it's due. And the remainder of the introduction may
provide some useful context too.

Change-Id: I99c7e599363126c581ae1ac00da67c33acc3687f
Reviewed-on: https://gerrit.openafs.org/12644
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Put jhutz's ubik analysis in doc/txt

A file in the source tree is much easier to locate than an old
mailing list post; it's quite handy to have this at hand as a
reference.

Change-Id: I5267a2f86b36e92b05249364085bdd33aeb28d1b
Reviewed-on: https://gerrit.openafs.org/12642
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: Improve "Corrupt directory" warning

This warning is a bit confusing to see, since it doesn't say anything
about AFS (making it unclear where it's coming from), and it lacks a
trailing newline (making it ugly). Fix both of these.

Change-Id: I92a3d07fd193bf99b545aef9b21f52d23c356a2d
Reviewed-on: https://gerrit.openafs.org/12641
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

vol: modify volume updateDate upon salvage change

If the salvager changed the volume, set the VolumeDiskData.updateDate
field so that

1. the change is visible via "vos examine"

2. backup services will backup the corrected volume

Teradactyl pointed out the problem which forces cell administrators
to manually trigger a backup for each volume that has been salvaged.

Change-Id: I9a35b92e8abbe3b54b08e64ac13de44442736c72
Reviewed-on: https://gerrit.openafs.org/12629
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

bozo: do not fail silently on unknown bosserver options

Instead of failing silently when the bosserver is started with an
unknown option, print an error message and exit with a non-zero value.
Continue to exit with 0 when the -help option is given to request the
usage message.

This change should help make bosserver startup failures more obvious
when an unsupported option is specified. Example systemd status message:

   systemd[1]: Starting OpenAFS Server Service...
   bosserver[32308]: Unrecognized option: -bogus
   bosserver[32308]: Usage: bosserver [-noauth] ....
   systemd[1]: openafs-server.service: main process exited,
               code=exited, status=1/FAILURE

Change-Id: I8717fb4a788fbcc3d1e2d271dd03511c5b504f10
Reviewed-on: https://gerrit.openafs.org/12630
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

rx: wake up send after 'twind' has been updated

Beginning in AFS 3.4 and 3.5 the ack trailer includes the size of the
peer's receive window.  This value is used to update the sender's
transmit window (twind).  When the twind is increased the application
thread is signaled to indicate that more packets can be sent.

This change wakes the application thread after twind is updated by
the peer's receive window instead of beforehand.  Failure to do so
can result in 100ms transmit delays when the receive window transitions
from closed to open.

Change-Id: Id129ea93e94612a4b8cce9f8cbddde9c779ff26b
Reviewed-on: https://gerrit.openafs.org/12625
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

LINUX: Switch to new bdi api for 4.12.

super_setup_bdi() dynamically allocates backing_dev_info structures
for filesystems and cleans them up on superblock destruction.

Appears with Linux commit fca39346a55bb7196888ffc77d9e3557340d1d0b
Author: Jan Kara <jack@suse.cz>
Date: Wed Apr 12 12:24:28 2017 +0200

Change-Id: I67eed0fcb8c96733390579847db57fb8a4f0df3e
Reviewed-on: https://gerrit.openafs.org/12614
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

LINUX: CURRENT_TIME macro goes away.

Check if the macro exists, define it if it does not.

Change-Id: I9990579f94bfba0804e60fa6ddcc077984cc46c3
Reviewed-on: https://gerrit.openafs.org/12611
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

redhat: update rpm spec file

Update the spec file to keep up with accumulated changes.

* Correct installation location of db check programs.
* Install afsd to the legacy location to avoid breaking
  init scrips and systemd configs.
* Exclude yet another duplicated copy of kpwvalid.
* libubik_pthread.a is gone.
* Install the kpwvalid man page.
* Continue to remove the obsolete kdb program.
* Update the names of the pam_afs symlinks.
* Add libkopenafs to authlibs.
* Package dafssync-debug man pages.
* Package opr/queue.h in devel.
* Package akeyconvert and man page.
* Do not package fuse version of afsd. A separate sub-package
  for afsd.fuse is warrented, since it adds new libfuse
  dependencies.
* Package new server man pages, including dafsssync-* pages.
* Package libafsrfc3961.a as a devel lib.
* Continue to package kauth programs.

Change-Id: I875c3b8dee53abbc67b0f05f8b291bb58abf41a5
Reviewed-on: https://gerrit.openafs.org/12595
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

FBSD: build fix for FreeBSD 11

r285819 eliminated b_saveaddr from struct buf, while r292373 changed the
arguments to VOP_GETPAGES. The approach used by this patch to address
these changes was inspired by FreeBSD's nfs and samba clients.

Change-Id: Ibcf6b6fde6c86f96aa814af2bca08f1a8b286740
Reviewed-on: https://gerrit.openafs.org/12575
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

redhat: convert rpm spec file to make install

Convert the build and install from the deprecated 'make dest' to the
modern 'make install' method.

* Clarify the install section by unrolling the shell scripts,
  reorganizing, and improving the comments.
* Remove the gzip glob of the man pages; rpmbuild automatically
  compresses the man pages and will handle symlinks correctly.
* Remove the generated temporary list file and specify files directly.
* Remove the extra tar commands to install the man pages out of the doc
  directory; 'make install..' installs the man pagess.
* Remove code in the install section which determines the sysname. This is
  no longer needed during the install.
* Update the kernel module install commands to accommodate the
  conversion from 'make dest'.

Change-Id: I97ec80185a2b11704b27ea74941b50ff4a5aca8c
Reviewed-on: https://gerrit.openafs.org/12594
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

redhat: fix whitespace errors in the rpm spec file

Remove trailing whitespace characters that have crept into
the rpm spec file over the years.

Change-Id: I08c7ad926ddb524d6938b26513963c28c70b4195
Reviewed-on: https://gerrit.openafs.org/12606
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

Linux: only include cred.h if it exists

Commit c89fd17df1032ec2eacc0d0c9b73e19c5e8db7d2 introduced an explicit
include of linux/cred.h since the latest kernel no longer includes it
implicitly in sched.h. Alas, older kernels (like 2.6.18) don't have this
file. Add a configure test for the existence of cred.h and only include
it if actually present.

Change-Id: Ia7e38160492b1e03cdb257e4b2bef4d18c4a28fb
Reviewed-on: https://gerrit.openafs.org/12593
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

Linux v4.11: cred.h is no longer included in sched.h

With Linux commit e26512fea5bcd6602dbf02a551ed073cd4529449, cred.h is no
longer included in sched.h.

Several components of libafs which require cred.h were picking it by
including sched.h.

Instead, explicitly add an include for cred.h. cred.h begins with a
customary one-shot to prevent multiple loads:

#ifndef _LINUX_CRED_H
#define _LINUX_CRED_H

Therefore we don't need a new autoconf test or preprocessor conditional
to prevent redundant includes on older Linux releases.

Change-Id: Ifc496c83141d2cfbd417133feb6d87c1146e5014
Reviewed-on: https://gerrit.openafs.org/12574
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Joe Gorse <jhgorse@gmail.com>
Tested-by: Joe Gorse <jhgorse@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>

Linux v4.11: signal stuff moved to sched/signal.h

In Linux commit c3edc4010e9d102eb7b8f17d15c2ebc425fed63c, signal_struct
and other signal handling declarations were moved from sched.h to
sched/signal.h.

This breaks existing OpenAFS autoconf tests for recalc_sigpending() and
task_struct.signal->rlim, so that the OpenAFS kernel module can no
longer build.

Modify OpenAFS autoconfig tests to cope.

Change-Id: Ic9f174b92704eabcbd374feffe5fbeb92c8987ce
Reviewed-on: https://gerrit.openafs.org/12573
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Joe Gorse <jhgorse@gmail.com>
Tested-by: Joe Gorse <jhgorse@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>

Linux v4.11: getattr takes struct path

With Linux commit a528d35e8bfcc521d7cb70aaf03e1bd296c8493f

    statx: Add a system call to make enhanced file info available

The Linux getattr inode operation is altered to take two additional
arguments: a u32 request_mask and an unsigned int flags that indicate
the synchronisation mode.  This change is propagated to the
vfs_getattr*() function.

-   int (*getattr) (struct vfsmount *, struct dentry *, struct kstat *);
+   int (*getattr) (const struct path *, struct kstat *,
+                     u32 request_mask, unsigned int sync_mode);

The first argument, request_mask, indicates which fields of the statx
structure are of interest to the userland call. The second argument,
flags, currently may take the values defined in
include/uapi/linux/fcntl.h and are optionally used for cache coherence:

(1) AT_STATX_SYNC_AS_STAT tells statx() to behave as stat() does.

(2) AT_STATX_FORCE_SYNC will require a network filesystem to
     synchronise its attributes with the server - which might require
     data writeback to occur to get the timestamps correct.

(3) AT_STATX_DONT_SYNC will suppress synchronisation with the server in
     a network filesystem.  The resulting values should be considered
     approximate.

This patch provides a new autoconf test and conditional compilation to
cope with the changes in our getattr implementation.

Change-Id: Ie4206140ae249c00a8906331c57da359c4a372c4
Reviewed-on: https://gerrit.openafs.org/12572
Reviewed-by: Joe Gorse <jhgorse@gmail.com>
Tested-by: Joe Gorse <jhgorse@gmail.com>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Prevent double-starting client on RHEL7

On RHEL7 if the AFS client is stopped with 'service openafs-client
stop', but that fails for some reason (most commonly because some
process has a file or directory in AFS open) systemd will decide that
the openafs-client is in a failed state when it is actually running.
If one then runs 'service openafs-client start' systemd will start a
new AFS client. At this point AFS access will continue to work until
the functional AFS client is (successfully) stopped, at which point a
reboot is required to recover.

Have systemd check the status of 'fs sysname' before starting the
AFS client, so we avoid getting into a state that requires a reboot.

Change-Id: I28a5cca746823d69183ea5ce65c10e1725009c5c
Reviewed-on: https://gerrit.openafs.org/12443
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

XBSD: do not claim AFS_VM_RDWR_ENV

The AFS_VM_RDWR_ENV configuration parameter (defined or not defined
in each platform's param.h) is undocumented, but appears to be an
indication of a property of the platform OS's VFS layer, or perhaps just
of the complexity of the read/write vnops that we implement for it.
That is, AFS_VM_RDWR_ENV is defined when the read/write vnops implement
partial write logic (and presumably when they interact with the OS VM
layer in ways not expressed by the afs_write() abstraction); systems
that do not define AFS_VM_RDWR_ENV can use the afs_write() function
fairly directly as the vnode operation.  Use of AFS_VM_RDWR_ENV
evolved over time, with the original (AFS 3.2/3.3-era) code using a
simple scheme that handled partial writes directly in afs_write()
and avoided complexity in callers. In AFS 3.4, sunos and solaris
gained a more complicated read/write vnop that incorporated the
afs_DoPartialWrite() call itself, and eventually in 3.6 we see the
behavior established at the original IBM import, with all the (Unix)
OSes supported at that time defining AFS_VM_RDWR_ENV.

When DARWIN support was brought in in commit
a41175cfbbf4d06ccfe14ae54bef8b7464ecd80b, its param.h properly did
not define AFS_VM_RDWR_ENV, as OS X uses a VFS interface that shares
some level of abstraction with the traditional BSD VFS and its
read/write/getpages/putpages operations, so the afs_write() behavior
was natural and no extra complications needed for integration with the
VM layer or other optimizations.

However, when the initial FreeBSD support came in a few months later,
it seems to have taken inspiration from the OSes that were supported
in the initial IBM import, and kept the AFS_VM_RDWR_ENV definition.
This was then propagated to all the later BSDs as they were added.

Perhaps the most noticeable consequence of this definition is that
the calls to afs_DoPartialWrite() from afs_write() are bypassed, with
a comment that "[i]f write is implemented via VM, afs_DoPartialWrite()
is called from the high-level write op" (and calls to afs_FakeOpen()
and afs_FakeClose() are similarly skipped).  This means that attempting
to write a file larger than the local cache will hang waiting for
more space to be freed, which will never happen as the vcache remains
locked and will not be written out in the background.

In the absence of a documented meaning for AFS_VM_RDWR_ENV, this
also gives us a proxy that can be used to indicate whether a given
OS's support intended to claim the AFS_VM_RDWR_ENV -- such platforms
will actually contain the call to afs_DoPartialWrite() in the
appropriate vnode operation.  This can be used to sanity-check the
places where AFS_VM_RDWR_ENV is removed by this commit.  Interestingly,
HP-UX does not call afs_DoPartialWrite() but also is clearly in a VFS
that uses a rdwr()-based approach, as the corresponding vnode operation
is implemented by mp_afs_rdwr(), so leave it unchanged for now.

Tim Creech is responsible for noting the lack of calls to
afs_DoPartialWrite() on FreeBSD, and Chaskiel Grundman for the
historical research into pre-OpenAFS AFS behavior.

Designing and implementing more complicated BSD read/write vnops that
incorporate afs_DoPartialWrite() and other improvements is left for
future work.

Change-Id: I8e89855ac31303934f97d0753b64899fb7e3867c
Reviewed-on: https://gerrit.openafs.org/12520
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Antoine Verheijen <apv@ualberta.ca>
Reviewed-by: Tim Creech <tcreech@tcreech.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

vol: detach offline volumes on dafs

Taking a volume offline always clears the inService bit. Taking a
volume out of service also takes it offline. Therefore, if the
inService flag is false, the volume in question should be offline.
On dafs, an offline volume should be unattached.

The attach2() function does not change the state of the volume received
as an argument to unattached when the inService flag is false. Instead,
this function changes the state of the volume in question to
pre-attached and returns VNOVOL to the client. As result, subsequent
accesses to this volume will make the server try and fail to attach
this offline volume over and over again, writing to the FileLog each
time.

To fix this problem, detach the volume received as an argument if the
inService flag is false. Since the new state of this volume will be
unattached, subsequent accesses will not hit attach2().

This situation where a volume is not offline but is also not in service
can occur if a volume is taken offline with vos offline and some time
later the DAFS fileserver is shutdown and restarted; the volume is
placed into the preattach state by default when the server restarts.
Each access to the volume by clients then causes the fileserver to
attempt to attach the volume, which fails, since the in-service flag in
the volume header is false from the previous vos offline. The
fileserver will log a warning to the FileLog on each attempt to attach
the volume, and this will fill the FileLog with duplicate messages
corresponding to the number of attempted accesses.

Change-Id: Ifce07c83c1e8dbf250b88b847d331234bdaa9df5
Reviewed-on: https://gerrit.openafs.org/12515
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

SOLARIS: prevent BAD TRAP panic with Studio 12.5

Starting with Solaris Studio 12.3, it is documented that Solaris kernel
modules (such as libafs) must not use any floating point, vector, or
SIMD/SSE instructions on x86 hardware.  However, each new Studio
compiler release (12.4 and especially 12.5) is more likely to use these
types of instructions by default.

If the libafs kernel module includes any forbidden kernel instructions,
Solaris will panic the system with:
  BAD TRAP:  type=7 (#nm Device not available)

Provide a new autoconfig test to specify the required compiler options
(-xvector=%none -xregs=no%float) when building the OpenAFS kernel module
for Solaris, so that no invalid x86 instructions are used.

In addition, reinstate default kernel module optimization for Solaris.
It had been disabled in commit 80592c53cbb0bce782eb39a5e64860786654be9f
to address this same issue in Studio 12.3 and 12.4.  However, Studio
12.5 started using some SSE instructions even with no optimization.

This commit has been tested with OpenAFS master and Studio 12.5 at all
optimization levels (none, -xO1 through -xO5) and verified to contain no
XMM register instructions via the following command:
  $ gobjdump -dlr libafs64.o | grep xmm | wc -l

Change-Id: Ic3c7860f7d524162fd9178a1dab5dd223722ee43
Reviewed-on: https://gerrit.openafs.org/12558
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

DAFS: do not save or restore host state if CPS in progress

If a fileserver is shutdown while one or more PR_GetHostCPS calls
are in progress, this state is saved in the fsstate.dat file as
hostFlags HCPS_WAITING, HCPS_INPROGRESS. Other hosts that are
merely waiting will have HCPS_WAITING recorded.

However, it makes no sense to restore host structs in this state,
because the GetCPS calls will no longer be in progress. Once these
hosts become active, they will block server threads and quickly cause
all server threads to be exhausted as other CPS requests are blocked
behind them.

Instead, exclude these states from both save and restore.

Change-Id: I3fad67b70c96dc967d6f8e3a7b393cfda076c91d
Reviewed-on: https://gerrit.openafs.org/12561
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

doc: clarify the fs wscell manpage

What's displayed by fs wscell is not necessarily the current content
of ThisCell, but that at the time of starting the client. Say so.

FIXES 133339

Change-Id: Id3351f1236e5061340eb07041d4ce3e4de69a1a1
Reviewed-on: https://gerrit.openafs.org/12537
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

osx: build afscell only for active architecture

The InstallerPlugins framework provided by the MacOSX10.12.sdk does not
define symbols for architecture i386. As a result, the OpenAFS code
cannot be built on OS X 10.12.

To fix this problem, build the afscell xcode project only for active
architecture.

Change-Id: I2a2bd5694826b668fceb7402567fba1d0f128479
Reviewed-on: https://gerrit.openafs.org/12531
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

libafs: vldb cache timeout option (-volume-ttl)

The unix cache manager caches VLDB information for read-only volumes as
long as a volume callback is held for a read-only volume.  The volume
callback may be held as long as files in the read-only volume are being
accessed.  The cache manager caches VLDB information for read/write
volumes as long as volume level errors (such as VMOVED) are not returned
by a fileserver while accessing files within the volume.

Add a new option to set the maximum amount of time VLDB information will
be cached, even if a callback is still held for a read-only volume, or
no volume errors have been encounted while accessing files in read/write
volumes.

This avoids situations where the vldb information is cached indefinitely
for read-only and read/write volumes.  Instead, the VL servers will be
periodically probed for volume information.

Change-Id: I5f2a57cdaf5cbe7b1bc0440ed6408226cc988fed
Reviewed-on: https://gerrit.openafs.org/11898
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

SOLARIS: update convert from ancient _depends_on

Commit 37db7985fde9e6a5e71ae628d0b7124a27bf31c3 modernized how we
declare module dependencies on Solaris 10 and newer.

Instead of explicitly specifying recent Solaris version numbers, specify
old versions for the old method. This should be more future proof.

Thanks to Ben Kaduk for the suggestion.

Change-Id: I7b3c90803825e2c0736548b56deb354183e81b15
Reviewed-on: https://gerrit.openafs.org/12529
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

build: update search paths for solaris cc

Move the macros to search for the solaris cc to a separate macro and
update the search paths to keep up with released versions.

Change-Id: Iaba816f1acf5f45d4e147ae517e73949eb8fe949
Reviewed-on: https://gerrit.openafs.org/12528
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

LINUX: Debian/Ubuntu build regression on kernel 3.16.39

Now that kernel 4.9 has hit jessie-backports, it becomes desirable to
also backport the associated openafs patches.

Unfortunately, Linux-4.9-inode_change_ok-becomes-setattr_prepare.patch
causes a build failure against jessie's current default kernel,
3.16.39-1, due to the fact that setattr_prepare() is available (it was
cherrypicked to address CVE-2015-1350) but file_dentry() is not (it was
introduced in kernel 4.6).

This makes it difficult to have a version of openafs for jessie that
supports both kernels.

To deal with this, follow the implementation of file_dentry() in 4.6,
and simplify it to account for the lack of d_real() support in older
kernels.

Note that inode_change_ok() has been added back to 3.16.39-1 to avoid
ABI changes. That means the current openafs packages in jessie continue
to work with kernel 3.16.39-1 since they do not include
Linux-4.9-inode_change_ok-becomes-setattr_prepare.patch.

Originally reported at
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=855366

FIXES RT134158

Change-Id: I157aa2ff25945c1c6e3b8e4a600557125711a681
Reviewed-on: https://gerrit.openafs.org/12523
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Linux 4.10: have_submounts is gone

Linux commit f74e7b33c37e vfs: remove unused have_submounts() function
(v4.10-rc2) removes have_submounts from the tree after providing a
replacement (path_has_submounts) for its last in-tree caller, autofs.

However, it turns out that OpenAFS is better off not using the new
path_has_submounts.  Instead, OpenAFS could/should have stopped using
have_submounts() much earlier, back in Linux v3.18 when d_invalidate
became void.  At that time, most in-tree callers of have_submounts had
already been converted to use check_submounts_and_drop back in v3.12.
At v3.18, a series of commits modified check_submounts_and_drop to
automatically remove child submounts (instead of returning -EBUSY if a
submount was detected), then subsumed it into d_invalidate.  The end
result was that VFS now implicitly handles much of the housekeeping
previously called explicitly by the various filesystem d_revalidate
routines:
- shrink_dcache_parent
- check_submounts_and_drop
- d_drop
- d_invalidate
All in-tree filesystem d_revalidate routines were updated to take
advantage of this new VFS support.

Modify afs_linux_dentry_revalidate to no longer perform any special
handling for invalid dentries when D_INVALIDATE_IS_VOID.  Instead, allow
our VFS caller to properly clean up any invalid dentry when we return 0.

Change-Id: I0c4d777e6d445857c395a7b5f9a43c9024b098e9
Reviewed-on: https://gerrit.openafs.org/12506
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

LINUX: Bring debug symbols back to the Linux kernel module.

Starting with 4.8 Linux kernels our existing build script
generator, make_kbuild_makefile.pl, does not pass the debugging
symbols CFLAGS that were present when building for previous kernels.

This fix appends the $(KERN_DBG) variable which will only be defined
when the configuration includes the --enable-debug-kernel option.

Change-Id: I9a85dc0311a3a706239bc9e471b2d7197ebe1946
Reviewed-on: https://gerrit.openafs.org/12519
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

build: add --without-swig to override swig check

Add the --without-swig option to disable the automatic swig detection
and disable the optional features which depend on swig.  This allows
builders to avoid swig even if present on the build system.

Also, add the --with-swig option to force the check and fail if not
detected.  This allows builders to declare the swig features are
mandatory.

The default continues to be to check for swig, and if present, build the
optional features which require swig.

To disable the automatic check for swig and disable the features which
depend on swig:

    ./configure --without-swig     # or --with-swig=no

To force the check and fail if swig is not present on the system:

    ./configure --with-swig        # or --with-swig=yes

If --with-swig is given and swig is not detected, then configure will
fail with the message:

    configure: error: swig requested but not found

The Perl 5 bindings for libuafs is the only feature which requires swig
at this time.

Change-Id: I0726658a9cc7b1b2a9d5e5d306adb6e36ad3c0f6
Reviewed-on: https://gerrit.openafs.org/12518
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

PERLUAFS: Modernize lang-specific swig typemaps

Currently, our swig bindings for PERLUAFS define a couple of typemaps
like so:

    %typemap(in, numinputs=1, perl5) (char *READBUF, int LENGTH) {
        [...]
    }

Embedding the target language name in the typemap arguments is a very
old way of specifying what language the typemap is for; they were
removed after swig 1.1. With swig 3.0.x releases (and possibly
others), the specific combination of this deprecated syntax and some
other features we're using causes a segfault. That's clearly a bug in
swig, but we shouldn't be using the deprecated syntax anyway.

Update this to instead use preprocessor symbols to specify
language-specific typemaps (#ifdef SWIGPERL). We only actually define
these for perl right now, so make sure to throw an error if we're not
running for perl.

FIXES 134103

Change-Id: I14264a2dfada53d99413808ed5d60b79b1ee44f3
Reviewed-on: https://gerrit.openafs.org/12517
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

AFS_component_version_number.c: Respect SOURCE_DATE_EPOCH if set

To improve build reproducibility, if the SOURCE_DATE_EPOCH environment
variable is set, use it to deterministically replace the embedded build
date, and do not include the username or hostname in this case.

https://wiki.debian.org/ReproducibleBuilds/TimestampsProposal

Change-Id: I9ba951f1836385ffd14aad95f071bf8c672a01bb
Reviewed-on: https://gerrit.openafs.org/12471
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

redhat: move the klog.krb5 man page to openafs-krb5

Move the klog.krb5 man page to the openafs-krb5 package, which
distributes the klog.krb5 binary, instead of the general openafs
package.

Change-Id: I6dc3896f330bb0c639cc75155f611ddaf11b9b75
Reviewed-on: https://gerrit.openafs.org/12509
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

SOLARIS: fix for AFS_PAG_ONEGROUP_ENV for Solaris 11

Fix a bug introduced in commit aab1e71628e6a4ce68c5e59e2f815867438280d1
in which a pointer was incorrectly checked for a NULL value.

Fixes a crash when a PAG is set on Solaris.

    # mdb unix.1 vmcore.1
    > ::status
    ...
    panic message:
    BAD TRAP: type=e (#pf Page fault) rp=fffffffc802ba8f0 addr=0 occurred in
      module "afs" due to a NULL pointer dereference
    > ::stack
    pag_to_gidset+0x145()
    setpag+0xcc()
    AddPag+0x3a()
    afs_setpag+0x58()
    Afs_syscall+0x115()

The crash occurs since gidslot is NULL during the assignment:

    *gidslot = pagvalue;

Change-Id: Ic4d50c6b046d10faa49cd4363692e0302707583d
Reviewed-on: https://gerrit.openafs.org/12508
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

osx: let prefpane knows where binaries can be found

Starting from OS X 10.11, the OpenAFS binaries were moved to the
following directories: /opt/openafs/bin and /opt/openafs/sbin. However,
the OpenAFS prefpane is not aware of the change mentioned above. As a
result, some functionalities provided by the OpenAFS prefpane are not
working properly.

To fix this problem, add the new paths to the proper environment
variable.

Change-Id: Idaa2f0329af2092cf9ad1d63f1a01300b150227a
Reviewed-on: https://gerrit.openafs.org/12507
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

LINUX: eliminate unused variable warning

Commit c3bbf0b4444db88192eea4580ac9e9ca3de0d286 added routine
osi_TryEvictDentries and included new logic for D_INVALIDATE_IS_VOID.
Unfortunately, this new code path no longer uses dentry; it also should
have been made conditional at that time.

Wrap the declaration of dentry in #ifndef D_INVALIDATE_IS_VOID to
eliminate the unused variable warning.

Change-Id: I89c1430ba984539ca775da2540ea966030de0701
Reviewed-on: https://gerrit.openafs.org/12505
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

cleanup afs_args.h

Collect the syscall op code (AFSOP_) defines in one section and cleanup
the use of whitespace and tabs.

This should be a non-functional change.

Change-Id: I1ba763a445b938fcb3677a388a703e1405ee166e
Reviewed-on: https://gerrit.openafs.org/12501
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

SOLARIS: Use AFS_PAG_ONEGROUP_ENV for Solaris 11

On Solaris 11 (specifically, Solaris 11.1+), the supplemental group
list for a process is supposed to be sorted. Starting with Solaris
11.2, more authorization checks are done that assume the list is
sorted (e.g., to do a binary search), so having them out of order
can cause incorrect behavior. For example:

  $ echo foo > /tmp/testfile
  $ chmod 660 /tmp/testfile
  $ sudo chown root:daemon /tmp/testfile
  $ cat /tmp/testfile
  foo
  $ id -a
  uid=100(adeason) gid=10(staff) groups=10(staff),12(daemon),20(games),21(ftp),50(gdm),60(xvm),90(postgres)
  $ pagsh
  $ cat /tmp/testfile
  cat: cannot open /tmp/testfile: Permission denied
  $ id -a
  uid=100(adeason) gid=10(staff) groups=33536,32514,10(staff),12(daemon),20(games),21(ftp),50(gdm),60(xvm),90(postgres)

Solaris sorts the groups given to crsetgroups() on versions which
required the group ids to be sorted, but we currently manually put our
PAG groups in our own order in afs_setgroups(). This is currently
required, since various places in the code assume that PAG groups are
the first two groups in a process's group list.

To get around this, do not require the PAG gids to be the first two
gids anymore. To more easily identify PAG gids in group processes, use
a single gid instead of two gids to identify a PAG, like modern Linux
currently uses (under the AFS_PAG_ONEGROUP_ENV). High-numbered groups
have been possible for quite a long time on Solaris, allegedly further
back than Solaris 8. Only do this for Solaris 11, though, to reduce
the platforms we affect.

[mmeffie@sinenomine.net: Define AFS_PAG_ONEGROUP_ENV in param.h.]

Change-Id: I44023ee8aa42f3f69bb0c8a8e9178abd513951a1
Reviewed-on: https://gerrit.openafs.org/11979
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

afsd_kernel: remove gratuitous OS dependence

Commit 94c15f62 in 2010 gave NetBSD and only NetBSD the debug
printing of errno and the strerror() output, with no justification
in the commit message. In the interest of unifying behavior and
avoiding unnecessary OS dependence, give all platforms the errno
and strerror() behavior.

[mmeffie@sinenomine.net: print errno iff syscall returns -1.]

Change-Id: If3c4e0ded54bbd4d5c2573f7d7ee1c82ee3e7223
Reviewed-on: https://gerrit.openafs.org/12500
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afsd: print syscalls on separate lines with afsd -debug

afsd prints information to standard out for testing and debugging when the
-debug option is given. However, syscall tracing is emitted without trailing
newlines on all platforms except netbsd, creating an unreadable wall of text.

    # afsd -debug
    ...
    afsd: Forking 4 background daemons.
    SScall(183, 28, 0)=0 183, 28, 6583200)=0 SScall(183, 28, 6583
    200)=0 SScall(183, 28, 6583200)=0 SScall(183, 28, 6583200)=0 S
    Scall(183, 28, 6583200)=0 SScall(183, 28, 6583200)=0 SScall(18
    ...

Make the syscall call tracing usable by printing each one on a separate line.

    # afsd -deubg
    ...
    afsd: Forking 4 background daemons.
    SScall(183, 28, 0)=0 183, 28, 6583200)=0
    SScall(183, 28, 6583200)=0
    SScall(183, 28, 6583200)=0
    ...

Change-Id: Ic9208243c1e05352744fb6f575384e00d0e3e59c
Reviewed-on: https://gerrit.openafs.org/12385
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

vol: convert vnode macros to inline functions

Convert the vnode macros to inline functions to fix integer overflows
for very large vnode numbers (and generally improve the code robustness
and readability).

The macro version of vnodeIndexOffset() will evaluate to an incorrect
offset for very large vnode numbers due to 32-bit integer overflow. The
vnode index file will then be corrupted when writing to the incorrect
offset.

In code paths where the vnode number incorrectly defined as a signed
32-bit integer, this change prevents vnodeIndexOffset() from evaluating
to a negative result when a vnode number is larger than 2^31.

Thanks to Mark Vitale for reporting and providing analysis.

Change-Id: Ia6e0f2d2f97fa1091e0b5a4029d40098692ee681
Reviewed-on: https://gerrit.openafs.org/12397
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

doc: add the PtLog man page

Clone the VLLog man page to create a man page for ptserver log as well.

Fix the spelling of the PtLog file and add a link to the new PtLog man
page in the ptserver man page.

Add the missing PtLog log file name to the bos getlog man page.

Change-Id: I95ad4a2cf380077780160ec78fd1f9bdec132ba7
Reviewed-on: https://gerrit.openafs.org/12294
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

opr: Make opr_uuid_hash endian-independent

And also make sure it doesn’t use unaligned accesses. Fixes a ‘make
check’ failure on big-endian architectures.

Change-Id: I490174f8d1eecb5f20969b4ef12ff16d0dd3806a
Reviewed-on: https://gerrit.openafs.org/12495
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>

opr: Make opr_jhash_opaque consistent with opr_jhash

Change-Id: I42e1030f8c841dcb974476012a774b91c87d3fb0
Reviewed-on: https://gerrit.openafs.org/12494
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

opr: Make opr_jhash_opaque endian-independent

gcc -O2 produces exactly the same code for this on little-endian
systems, but now big-endian systems have a chance of passing ‘make
check’.

Change-Id: Ifc6350648355a0a9f79184439e3f9522cd6f2ffa
Reviewed-on: https://gerrit.openafs.org/12493
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

opr: ExitHandler: re-raise the signal instead of exiting with that code

This fixes a ‘make check’ failure introduced by commit
803d15b6aa1e65b259ba11ca30aa1afd2e12accb “vlserver: convert the vlserver
to opr softsig”:

    $ make check
    …
    volser/vos..............FAILED 6
    …
    $ cd tests
    $ ./libwrap ../lib ./runtests -o volser/vos
    1..6
    ok 1 - Successfully got security class
    ok 2 - Successfully built ubik client structure
    ok 3 - First address registration succeeds
    ok 4 - Second address registration succeeds
    ok 5 - vos output matches
    Server exited with code 15
    # wanted: 0
    #   seen: -1
    not ok 6 - Server exited cleanly
    # Looks like you failed 1 test of 6

afstest_StopServer has a check for the process terminating with signal
15 (SIGTERM), but not for the process exiting with code 15.

Change-Id: I022965ea2b5440486ea1cf562551d3bbd0516104
Reviewed-on: https://gerrit.openafs.org/12489
Tested-by: Anders Kaseorg <andersk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

doc/man-pages/Makefile.in: mkdir man[158] in case we did regen.sh -q

Fixes this error:

$ git clean -xdf
$ ./regen.sh -q
$ ./configure
$ make
[…]
make[3]: Entering directory '/…/openafs/doc/man-pages'
rm -f man*/*.noinstall
if [ "no" = "no" ] ; then \
for M in man1/klog.1 man1/knfs.1 […] man8/kpwvalid.8 man1/klog.krb.1; do \
touch $M.noinstall; \
done; \
fi
touch: cannot touch 'man1/klog.1.noinstall': No such file or directory
touch: cannot touch 'man1/knfs.1.noinstall': No such file or directory
[…]
touch: cannot touch 'man8/kpwvalid.8.noinstall': No such file or directory
touch: cannot touch 'man1/klog.krb.1.noinstall': No such file or directory
Makefile:34: recipe for target 'prep-noinstall' failed
make[3]: *** [prep-noinstall] Error 1
make[3]: Leaving directory '/…/openafs/doc/man-pages'

Change-Id: I95098fb2b27f1d87fc9769497b225e9f91f72266
Reviewed-on: https://gerrit.openafs.org/12492
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

tests/opr/softsig-t: Avoid hanging due to intermediate sh -c

If the build directory happened to contain shell metacharacters, like
the ~ in /build/openafs-vb8tid/openafs-1.8.0~pre1 used by the Debian
builders, Perl was running softsig-helper via an intermediate sh -c,
which would then intercept the signals we tried to send to
softsig-helper. Use the list syntax to avoid this sh -c.

Change-Id: I054b9c8f606e197accb414bfe3f89719255c62c4
Reviewed-on: https://gerrit.openafs.org/12488
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

tests: use exec to call libwrap'd executables

No need to leave the shell process hanging around.

In particular, if we are manually running softsig-helper under
libwrap to debug test failures, the child process of the shell is
another shell, which interprets some signals that we wanted to
be passed through, like SIGTERM. On the other hand, once the
softsig-helper is exec()'d, you basically need another shell to
terminate it, which is a different problem....

Change-Id: Iff7c519886a018cb68e692746d40c427b6299457
Reviewed-on: https://gerrit.openafs.org/12490
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Anders Kaseorg <andersk@mit.edu>
Tested-by: Anders Kaseorg <andersk@mit.edu>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

tests: fix signo to signame lookup in opr/softsig tests

Fix the loop condition when scanning the signal number to name table to
convert a signal number to a name.  Instead of looping sizeof(size_t)
times, loop for the number of elements in the table.

This bug was masked on 64 bit-platforms, since the signal number to name
table table currently has 8 elements, which is coincidently the same as
sizeof(size_t) on 64-bit platforms.  The bug becomes apparent on 32-bit
systems; only the first 4 elements of the table are checked.

Example error output before this fix:

    $ cd tests
    $ ./libwrap ../lib ./runtests -o opr/softsig
    1..11
    ok 1
    ok 2
    ok 3
    ok 4
    ok 5
    not ok 6
    # Failed test in ./opr/softsig-t at line 57.
    # got: 'Received UNK
    # '
    # expected: 'Received TERM
    # '
    not ok 7
    # Failed test in ./opr/softsig-t at line 60.
    # got: 'Received UNK
    # '
    # expected: 'Received USR1
    # '
    not ok 8
    # Failed test in ./opr/softsig-t at line 63.
    # got: 'Received UNK
    # '
    # expected: 'Received USR2
    # '
    ok 9 - Helper exited on KILL signal.
    ok 10 - Helper exited on SEGV signal.
    ok 11 # skip Skipping buserror test; SIGBUS constant is not defined.
    # Looks like you failed 3 tests of 11.

Change-Id: I863cc9f3650c4a5e9ac9159d90e063b986a8460a
Reviewed-on: https://gerrit.openafs.org/12367
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

s390: desupport 32-bit Linux kernels on s390/s390x

Remove the obsolete and custom lwp assembler for the s390 and s390x
architectures. That assembler is no longer needed since 32-bit
mainframe Linux distributions are no longer supported and are very
unlikely to be in use.

The generic process.default.s is sufficient for modern 64-bit Linux
distributions on s390/s390x.

[mmeffie@sinenomine.net: commit message wording]

Change-Id: I654b10dfc257e7de90c9a50048982427276f4d61
Reviewed-on: https://gerrit.openafs.org/12475
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: fs getcacheparms miscounts dcaches for large files

fs getcacheparms issued with the -excessive option tabulates in-memory
dcaches ("DCentries") by size.  However, any dcache with validPos > 2^31
is miscounted in the 4k-16k bucket.  This is caused by a type mismatch
between 'validPos' (afs_size_t) and 'size' (int) which leads to a
negative value for size by sign-extension.  The size comparison "sieve"
fails for negative numbers; it skips the first bucket (0-4K) and dumps
them in the second one (4k-16k).

Move the declaration of 'size' closer to its use, and declare it with
the same type as 'validPos' (afs_size_t) so the comparison sieve
correctly places these dcaches in the last (>=1M) bucket.

Change-Id: Ib0d973da92865043a4f1c068de5e9b81bcde2b9a
Reviewed-on: https://gerrit.openafs.org/12347
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: fs getcacheparms miscounts zero-length dcaches

When fs getcacheparms is issued with the -excessive option, it
tabulates all in-memory dcaches ("DCentries") by size.

dcaches with validPos == 0 were being tabulated in the 4k-16k bucket.

Fix the first comparison in the 'sieve' so these dcaches will be counted
in the correct 0-4k bucket instead.

Introduced by commit 176c2fddb95ced6c13e04e7492fc09b5551f273c

Change-Id: I60acb0f115dad9f7951f0b17e5b3e37dc94321b9
Reviewed-on: https://gerrit.openafs.org/12346
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

Make OpenAFS 1.8.0pre1

Update version strings for the first 1.8.0 prerelease.

Change-Id: I4f534c9934f6eb1baac9a784fb7c357b19924fb0
Reviewed-on: https://gerrit.openafs.org/12470
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Update NEWS for 1.8

[kaduk@mit.edu: adjust sorting, rewrap, reword a few entries and
remove some entries that will not be applicable]

Change-Id: Ifbadc31e3f201e05617a26c12e5e725a5f3c9195
Reviewed-on: https://gerrit.openafs.org/12393
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

Import NEWS from openafs-stable-1_6_x

The 1.6.x changelog entries have been going directly on the
openafs-stable-1_6_x branch for ease of maintenance.

However, we don't want to skip those changes when mentioning changes
in OpenAFS 1.8, so pull back a copy onto master before adding
things for 1.8.

Change-Id: I545c19db9854300a84295d3ca8b1f301756c38b0
Reviewed-on: https://gerrit.openafs.org/12392
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Update libafsdep files for in-kernel fortuna

Commit 0d67b00ff9db added heimdal's rand-fortuna PRNG to the kernel
module on all architectures, even though it is only needed on the small
subset that do not provide a cryptographically strong random number
generator to kernel module consumers. This was done to ensure that
the build infrastructure for it gets regularly exercised by developers.
However, not all build infrastructure was exercised at the time of
that submission; in particular, the make_libafs_tree.pl script was
not tested. This led to a situation where the libafs tree generated
by that script omitted several files that were now referenced by
the kernel build due to the fortuna import.

To remedy the situation, list the additional files that are needed,
so that they will be copied into the build area for this class of
kernel module builds.

Since the libafs-tree functionality is used to build the Debian
kernel-module source packages, this fix is needed in order to have
a tree that can be built into debian packages without patching.

Change-Id: I81502fb61d7fc718d337c5f73a51b88f6a433d6a
Reviewed-on: https://gerrit.openafs.org/12473
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

src/cf/roken.m4: Escape buildtool_roken correctly

Fixes these errors from configure:

./configure: line 32154: LDFLAGS_roken: command not found
./configure: line 32154: LIB_roken: command not found

Change-Id: I63b9ade5c8f55948ea2a3f7ae023de4ed9f62341
Reviewed-on: https://gerrit.openafs.org/12472
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

rx: Add rxi_FlushWriteLocked

Currently, a couple of places in Rx do this:

    MUTEX_EXIT(&call->lock);
    rxi_FlushWrite(call);
    MUTEX_ENTER(&call->lock);

This is a little silly, because if rxi_FlushWrite has anything to do,
it just acquires/drops call->lock again.

This seems like a very minor performance penalty, but in the right
situation it can become more noticeable. Specifically, when an Rx call
on the server ends successfully, rx_EndCall will rxi_FlushWrite (to
send out the last Rx packet to the client) before marking the call as
finished. If the client receives the last Rx packet and starts a new
Rx call on the same channel before the server locks the call again,
the client can receive a BUSY packet (because it looks like the
previous call on the server hasn't finished yet). Nothing breaks, but
this means the client waits 3 seconds to retry.

This situation can probably happen with various rates of success in
almost any situation, but I can see it consistently happen with 'vos
move' when running 'vos' on the same machine as the source fileserver.
It is most noticeable when moving a large number of small volumes
(since you must wait an extra 3+ seconds per volume, where nothing is
happening).

To avoid this, create a new variant of rxi_FlushWrite, called
rxi_FlushWriteLocked. This just assumes the call lock is already held
by the caller, and avoids one extra lock/unlock pair. This is not the
only place where we unlock/lock the call during the rx_EndCall
situation described above, but it seems to be easiest to solve, and
it's enough (for me) to avoid the 3-second delay in the 'vos move'
scenario. Ideally, Rx should be able to atomically 'end' a call while
sending out this last packet, but for now, this commit is easy to do.

Note that rxi_FlushWrite previously didn't do much of note before
locking the call. It did call rxi_FreePackets without the call lock,
but calling that with the call lock is also fine; other callers do
that.

Change-Id: I8f71e86f6c1f6019abea21c205d2b26b7da0d808
Reviewed-on: https://gerrit.openafs.org/12421
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

pts: add some sanity checks in ptuser.c

Double-check that when we're expecting two entries back, we
actually got two entries, in addition to the RPC return value.

Change-Id: I34631ac542667c337ed3268153eb61c70e3fa87e
Reviewed-on: https://gerrit.openafs.org/11668
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

LINUX: Don't compile syscall code with keyrings

osi_syscall_init() is not currently called if we have kernel keyrings
support, since we don't need to set up or alter any syscalls if we
have kernel keyrings (we track PAGs by keyrings, and we use ioctls
instead of the AFS syscall now).

Since we don't call it, this commit makes us also not compile the
relevant syscall-related code. This allows new platforms to be added
without needing to deal with any platform-specific code for handling
32-bit compat processes and such, since usually we don't need to deal
with intercepting syscalls.

To do this, we just define osi_syscall_init and osi_syscall_cleanup as
noops if we have keyrings support. This allows us to reduce the #ifdef
clutter in the actual callers.

Note that the 'afspag' module does currently call osi_syscall_init
unconditionally, but this seems like an oversight. With this change,
the afspag module will no longer alter syscalls when we have linux
keyrings support.

Change-Id: I219b92d89303975765743712587ff897b55a2631
Reviewed-on: https://gerrit.openafs.org/11936
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

vos: fix vos release -verbose output

Fix incorrect vos release -verbose messages introduced by commit
9f4684cd5fac5eacf571b882e965150943383170.

The commit 9f4684cd5fac5eacf571b882e965150943383170 did not take into
account the change from commit 3fc800be9c702c1a40869908831a9895602909cb
in which a partial commit is performed when just new sites are added and
the read-write volume was not changed since the previous release.

Change-Id: If4b3ab81cd810df2e866d6eca0152f475c5448d6
Reviewed-on: https://gerrit.openafs.org/12455
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: release the packets used by rx on shutdown

When the OpenAFS client is unmounted on DARWIN, the blocks of packets
allocated by RX are released. Historically, the memory used by those
packets was never properly released.

Before 230dcebcd61064cc9aab6d20d34ff866a5c575ea, only the last block of
packets used to be released:

...
struct rx_packet *rx_mallocedP = 0;
...
void
rxi_MorePackets(int apackets)
{
    ...
    getme = apackets * sizeof(struct rx_packet);
    p = rx_mallocedP = (struct rx_packet *)osi_Alloc(getme);
    ...
}
...
void
rxi_FreeAllPackets(void)
{
    ...
    osi_Free(rx_mallocedP, ...);
    ...
}
...

As we can see, ‘rx_mallocedP’ is a global pointer that stores the
first address of the last allocated block of packets. As a result, when
‘rxi_FreeAllPackets’ is called, only the last block is released.

However, 230dcebcd61064cc9aab6d20d34ff866a5c575ea moved the global
pointer in question to the end of the last block. As a result, when the
OpenAFS client is unmounted on DARWIN, the ‘rxi_FreeAllPackets’
function releases the wrong block of memory. This problem was exposed
on OS X 10.12 Sierra where the system crashes when the OpenAFS client
is unmounted.

To fix this problem, store the address of every single block of packets
in a queue and release one by one when the OpenAFS client is unmounted.

Change-Id: Ibd6bd1a8bc45bb4802f9381a8e600c20ee85a59e
Reviewed-on: https://gerrit.openafs.org/12427
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

dir: do not leak contents of deleted directory entries

Deleting an AFS directory entry (afs_dir_Delete) merely removes the
entry logically by updating the allocation map and hash table.  However,
the entry itself remains on disk - that is, both the cache manager's
cache partition and the fileserver's vice partitions.

This constitutes a leak of directory entry information, including the
object's name and MKfid (vnode and uniqueid).  This leaked information
is also visible on the wire during FetchData requests and volume
operations.

Modify afs_dir_Delete to clear the contents of deleted directory
entries.

Patchset notes:
This commit only prevents leaks for newly deleted entries.  Another
commit in this patchset prevents leaks of partial object names upon
reuse of pre-existing deleted entries.  A third commit in this
patchset prevents yet another kind of directory entry leak, when
internal buffers are reused to create or enlarge existing directories.
All three patches are required to prevent new leaks.  Two additional
salvager patches are also included to assist administrators in the
cleanup of pre-existing leaks.

[kaduk@mit.edu: style nit for sizeof() argument]

Change-Id: Iabaafeed09a2eb648107b7068eb3dbf767aa2fe9
Reviewed-on: https://gerrit.openafs.org/12460
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

afs: do not leak stale data in buffers

Similar to the previous commit, zero out the buffer when fetching
a new slot, to avoid the possibility of leaving stale data in
a reused buffer.

We are not supposed to write such stale data back to a fileserver,
but this is an extra precaution in case of bugs elsewhere -- memset
is not as expensive as it was in the 1980s.

Change-Id: I344e772e9ec3d909e8b578933dd9c6c66f0a8cf6
Reviewed-on: https://gerrit.openafs.org/12459
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

dir: fileserver leaks names of file and directories

Summary:
Due to incomplete initialization or clearing of reused memory,
fileserver directory objects are likely to contain "dead" directory
entry information.  These extraneous entries are not active - that is,
they are logically invisible to the fileserver and client.  However,
they are physically visible on the fileserver vice partition, on the
wire in FetchData replies, and on the client cache partition.  This
constitutes a leak of directory information.

Characterization:
There are three different kinds of "dead" residual directory entry
leaks, each with a different cause:

1. There may be partial name data after the null terminator in a live
directory entry.   This happens when a previously used directory entry
becomes free, then is reused for a directory entry with a shorter name.
This may be addressed in a future commit.

2. "Dead" directory entries are left uncleared after an object is
deleted or renamed.  This may be addressed in a future commit.

3. Residual directory entries may be inadvertently picked up when a new
directory is created or an existing directory is extended by a 2kiBi
page.  This is the most severe problem and is addressed by this commit.

This third kind of leak is the most severe because the leaked
directory information may be from _any_ other directory residing on the
fileserver, even if the current user is not authorized to see that
directory.

Root cause:
The fileserver's directory/buffer package shares a pool of directory
page buffers among all fileserver threads for both directory reads and
directory writes.  When the fileserver creates a new directory or
extends an existing one, it uses any available unlocked buffer in the
pool.  This buffer is likely to contain another directory page recently
read or written by the fileserver.  Unfortunately the fileserver only
initializes the page header fields (and the first two "dot" and "dotdot"
entries in the case of a new directory).  Any residual entries in the
rest of the directory page are now logically "dead", but still
physically present in the directory.  They can easily be seen on the
vice partition, on the wire in a FetchData reply, and on the cache
partition.

Note:
The directory/buffer package used by the fileserver is also used by the
salvager and the volserver.  Therefore, salvager activity may also leak
directory information to a certain extent.   The volserver vos split
command may also contribute to leaks.  Any volserver operation that
creates volumes (create, move, copy, restore, release) may also have
insignificant leaks.  These less significant leaks are addressed by this
commit as well.

Exploits:
Any AFS user authorized to read directories may passively exploit this
leak by capturing wire traffic or examining his local cache as he/she
performs authorized reads on existing directories.  Any leaked data will
be for other directories the fileserver had in the buffer pool at the
time the authorized directories were created or extended.

Any AFS user authorized to write a new directory may actively exploit
this leak by creating a new directory, flushing cache, then re-reading
the newly created directory.  Any leaked data will be for other
directories the fileserver had in the buffer pool within the last few
seconds.  In this way an authorized user may sample current fileserver
directory buffer contents for as long as he/she desires, without being
detected.

Directories already containing leaked data may themselves be leaked,
leading to multiple layers of leaked data propagating with every new or
extended directory.

The names of files and directories are the most obvious source of
information in this leak, but the FID vnode and uniqueid are leaked as
well.  Careful examination of the sequences of leaked vnode numbers and
uniqueids may allow an attacker to:
- Discern each layer of old directories by observing breaks in
  consecutive runs of vnode and/or uniqueid numbers.
- Infer which objects may reside on the same volume.
- Discover the order in which objects were created (vnode) or modified
  (uniqueid).
- Know whether an object is a file (even vnode) or a directory (odd
  vnode).

Prevent new leaks by always clearing a pool buffer before using it to
create or extend a directory.

Existing leaks on the fileserver vice partitions may be addressed in a
future commit.

Change-Id: Ia980ada6a2b1b2fd473ffc71e9fd38255393b352
Reviewed-on: https://gerrit.openafs.org/12458
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

bos: re-add -salvagedirs for use with -all

The MR-AFS support code had a -salvagedirs option that was passed
through to the salvager (when running, and when -all was used),
that was removed in commit a9301cd2dc1a875337f04751e38bba6f1da7ed32
along with the rest of the MR-AFS commands and options.

However, it is useful in its own right, so add it back and allow
the use of -salvagedirs -all to rebuild every directory on the server.

Change-Id: Ifc9c0e4046bf049fe04106aec5cad57d335475e3
Reviewed-on: https://gerrit.openafs.org/12457
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

dafs: honor salvageserver -salvagedirs

Do not ignore the -salvagedirs option when given to the salvageserver.
When the salvageserver is running with this option, all directories will
be rebuilt by salvages spawned by the dafs salvageserver, including all
demand attach salvages and salvages of individual volumes initiated by
bos salvage.

This does not affect the whole partition salvages initiated by bos
salvage -all.

Change-Id: I4dd515ffa8f962c61e922217bee20bbd88bcd534
Reviewed-on: https://gerrit.openafs.org/12456
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Remove NULL checks for AFS_NONNULL parameters

Recent GCC warns about opr_Assert(p != NULL), where p is an
__attribute__((__nonnull__)) parameter, just like clang did before those
clang warnings were silenced by 11852, 11853.

Now, we could go and add more autoconf tests and pragmas to silence the
GCC versions of these warnings.  However, I maintain that silencing the
warnings is the wrong approach.  The asserts in question have no
purpose.  They do not add any safety, because GCC and clang are
optimizing them away at compile time (without proof!—they take the
declaration at its word that NULL will never be passed).  Just remove
them.

Fixes these warnings (errors with --enable-checking) from GCC 6.2:

In file included from casestrcpy.c:17:0:
casestrcpy.c: In function ‘opr_lcstring’:
casestrcpy.c:26:31: error: nonnull argument ‘d’ compared to NULL [-Werror=nonnull-compare]
     opr_Assert(s != NULL && d != NULL);
                               ^
/…/openafs/include/afs/opr.h:28:15: note: in definition of macro ‘__opr_Assert’
     do {if (!(ex)) opr_AssertionFailed(__FILE__, __LINE__);} while(0)
               ^~
casestrcpy.c:26:5: note: in expansion of macro ‘opr_Assert’
     opr_Assert(s != NULL && d != NULL);
     ^~~~~~~~~~
casestrcpy.c:26:18: error: nonnull argument ‘s’ compared to NULL [-Werror=nonnull-compare]
     opr_Assert(s != NULL && d != NULL);
                  ^
/…/openafs/include/afs/opr.h:28:15: note: in definition of macro ‘__opr_Assert’
     do {if (!(ex)) opr_AssertionFailed(__FILE__, __LINE__);} while(0)
               ^~
casestrcpy.c:26:5: note: in expansion of macro ‘opr_Assert’
     opr_Assert(s != NULL && d != NULL);
     ^~~~~~~~~~
casestrcpy.c: In function ‘opr_ucstring’:
casestrcpy.c:46:31: error: nonnull argument ‘d’ compared to NULL [-Werror=nonnull-compare]
     opr_Assert(s != NULL && d != NULL);
                               ^
/…/openafs/include/afs/opr.h:28:15: note: in definition of macro ‘__opr_Assert’
     do {if (!(ex)) opr_AssertionFailed(__FILE__, __LINE__);} while(0)
               ^~
casestrcpy.c:46:5: note: in expansion of macro ‘opr_Assert’
     opr_Assert(s != NULL && d != NULL);
     ^~~~~~~~~~
casestrcpy.c:46:18: error: nonnull argument ‘s’ compared to NULL [-Werror=nonnull-compare]
     opr_Assert(s != NULL && d != NULL);
                  ^
/…/openafs/include/afs/opr.h:28:15: note: in definition of macro ‘__opr_Assert’
     do {if (!(ex)) opr_AssertionFailed(__FILE__, __LINE__);} while(0)
               ^~
casestrcpy.c:46:5: note: in expansion of macro ‘opr_Assert’
     opr_Assert(s != NULL && d != NULL);
     ^~~~~~~~~~
casestrcpy.c: In function ‘opr_strcompose’:
/…/openafs/include/afs/opr.h:28:12: error: nonnull argument ‘buf’ compared to NULL [-Werror=nonnull-compare]
     do {if (!(ex)) opr_AssertionFailed(__FILE__, __LINE__);} while(0)
            ^
/…/openafs/include/afs/opr.h:37:25: note: in expansion of macro ‘__opr_Assert’
# define opr_Assert(ex) __opr_Assert(ex)
                         ^~~~~~~~~~~~
casestrcpy.c:98:5: note: in expansion of macro ‘opr_Assert’
     opr_Assert(buf != NULL);
     ^~~~~~~~~~
kalocalcell.c: In function ‘ka_CellToRealm’:
/…/openafs/include/afs/opr.h:28:12: error: nonnull argument ‘realm’ compared to NULL [-Werror=nonnull-compare]
     do {if (!(ex)) opr_AssertionFailed(__FILE__, __LINE__);} while(0)
            ^
/…/openafs/include/afs/opr.h:37:25: note: in expansion of macro ‘__opr_Assert’
# define opr_Assert(ex) __opr_Assert(ex)
                         ^~~~~~~~~~~~
kalocalcell.c:117:5: note: in expansion of macro ‘opr_Assert’
     opr_Assert(realm != NULL);
     ^~~~~~~~~~

Change-Id: I6fd618ed49255d7b3de2f8f3424d9659890829c0
Reviewed-on: https://gerrit.openafs.org/12442
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Mac OS Sierra deprecates syscall()

The syscall() function has been deprecated in MacOS 10.12 - Sierra. After
discussions with developers, it would appear that syscall() isn't really
needed, anymore, so we can just do away with it.

Change-Id: I60e4220168b097bbae7a5ebaceb2d32276aad3e5
Reviewed-on: https://gerrit.openafs.org/12452
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

Define OSATOMIC_USE_INLINED to get usable atomics on DARWIN

In Mac OS 10.12, legacy interfaces for atomic operations have been
deprecated. Defining OSATOMIC_USE_INLINED gets us inline implementations
of the OSAtomic interfaces in terms of the <stdatomic.h> primitives.
This is a transition convenience.

Also indent preprocessor directives within the main DARWIN block to
improve readability.

Change-Id: Id10ae007d5427486f1b0a307a04a90f263201150
Reviewed-on: https://gerrit.openafs.org/12433
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

doc: update information about vlserver logging

Mention the vlserver -d option can be used to set the initial logging
level.

Thanks to Mark Vitale for the suggestion.

Change-Id: Ia17a2063432343c2cf78e1b01c5897751625aae8
Reviewed-on: https://gerrit.openafs.org/12324
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

SOLARIS: convert from ancient _depends_on to ELF dependencies

The ancient way of declaring module dependencies with _depends_on has
been deprecated since SunOS 2.6 (circa 1996). The presence of the old
_depends_on symbol triggers a warning message on the console starting
with Solaris 12, and the kernel runtime loader (krtld) feature of using
the _depends_on symbol to load dependencies may be removed in a future
version of Solaris.

Convert the kernel module from the ancient _depends_on method to modern
ELF dependencies. Remove the old _depends_on symbol and specify the -dy
and -N <name> linker options to set the ELF dependencies at link time,
as recommended in the Solaris device driver developer guidelines [1].

This commit does not change the declared dependencies, which may be
vestiges of ancient afs versions.

[1]: http://docs.oracle.com/cd/E19455-01/805-7378/6j6un037u/index.html#loading-16

Change-Id: Ic5abd82108cd59c0796a8d7659ddaffa791dbeee
Reviewed-on: https://gerrit.openafs.org/12453
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

doc: correct help for 'bos getlog' -restricted mode

Commit f085951d39c0d6c1e6a626177c30235704317600 introduced an error in
the bos getlog helpfile.

Modify the helpfile to describe the actual restrictions imposed by
-restricted mode.

Change-Id: I8d8fedb558a1bdbd55d80046b2011f3aacc71b3f
Reviewed-on: https://gerrit.openafs.org/12454
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

LINUX: do not use d_invalidate to evict dentries

When working within the AFS filespace, commands which access large
numbers of OpenAFS files (e.g., git operations and builds) may result in
active files (e.g., the current working directory) being evicted from the
dentry cache.  One symptom of this is the following message upon return
to the shell prompt:

"fatal: unable to get current working directory: No such file or
directory"

Starting with Linux 3.18, d_invalidate returns void because it always
succeeds.  Commit a42f01d5ebb13da575b3123800ee6990743155ab adapted
OpenAFS to cope with the new return type, but not with the changed
semantics of d_invalidate.  Because d_invalidate can no longer fail with
-EBUSY when invoked on an in-use dentry. OpenAFS must no longer trust it
to preserve in-use dentries.

Modify the dentry eviction code to use a method (d_prune_aliases) that
does not evict in-use dentries.

Change-Id: I1826ae2a89ef4cf6b631da532521bb17bb8da513
Reviewed-on: https://gerrit.openafs.org/12363
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

macos: do not quit prefpane unexpectedly

If the user opens the OpenAFS preference pane and choose the Mounts
tab, the preference pane crashes.

To fix the problem, do not assume that we can cast a NSdictionary
object to NSMutableDictionary.

Change-Id: I3b5f6cb324a6b53c6b53606f71185f61450ee793
Reviewed-on: https://gerrit.openafs.org/12446
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>

salvager: fix error message for invalid volumeid

If the specified volumeid is invalid (e.g. volume name was specified
instead of volume number), the error is reported via Log(). However,
commit 24fed351fd13b38bfaf9f278c914a47782dbf670 moved the log opening
logic from before this check to after it, effectively making this Log()
call a no-op.

Instead, use fprintf to issue the error message.

Change-Id: I488bc93b178c7973e48d7c9ef4e7ecde9ba62696
Reviewed-on: https://gerrit.openafs.org/12288
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>

src/tools/rxperf/rxperf.c: Fix misleading indentation

Fixes these warnings (errors with --enable-checking) from GCC 6.2:

rxperf.c: In function ‘rxperf_server’:
rxperf.c:930:4: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
    if (ptr && *ptr != '\0')
    ^~
rxperf.c:932:6: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
      break;
      ^~~~~
rxperf.c: In function ‘rxperf_client’:
rxperf.c:1102:4: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
    if (ptr && *ptr != '\0')
    ^~
rxperf.c:1104:6: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
      break;
      ^~~~~

Change-Id: I4e8e1f75ec14fa9f95441275cfc136adbb448e9e
Reviewed-on: https://gerrit.openafs.org/12440
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

src/gtx/curseswindows.c: Fix misleading indentation

Fixes these warnings (errors with --enable-checking) from GCC 6.2:

curseswindows.c: In function ‘gator_cursesgwin_drawchar’:
curseswindows.c:574:5: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
     if (params->highlight)
     ^~
curseswindows.c:576:9: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
         if (code)
         ^~
curseswindows.c:579:5: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
     if (params->highlight)
     ^~
curseswindows.c:581:9: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
         if (code)
         ^~
curseswindows.c: In function ‘gator_cursesgwin_drawstring’:
curseswindows.c:628:5: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
     if (params->highlight)
     ^~
curseswindows.c:630:2: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
  if (code)
  ^~
curseswindows.c:633:5: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
     if (params->highlight)
     ^~
curseswindows.c:635:2: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
  if (code)
  ^~

Change-Id: Ib53eb5755eebb5e22a5414ced8a2540825b41e15
Reviewed-on: https://gerrit.openafs.org/12439
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>

src/afsd/afsd.c: Fix misleading indentation

Fixes these warnings (errors with --enable-checking) from GCC 6.2:

afsd.c: In function ‘afsd_run’:
afsd.c:2176:6: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
      if (enable_rxbind)
      ^~
afsd.c:2178:3: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
   afsd_syscall(AFSOP_ADVISEADDR, code, addrbuf, maskbuf, mtubuf);
   ^~~~~~~~~~~~
afsd.c:2487:5: error: this ‘if’ clause does not guard... [-Werror=misleading-indentation]
     if (afsd_debug)
     ^~
afsd.c:2490:2: note: ...this statement, but the latter is misleadingly indented as if it is guarded by the ‘if’
  afsd_syscall(AFSOP_GO, 0);
  ^~~~~~~~~~~~

Change-Id: Ic4769046dc06bb58d61428ac08ea12a2f70743e9
Reviewed-on: https://gerrit.openafs.org/12438
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>