The double free would occur if
1) some thread invoked Cancel() to queue destruction of a ProxyIostate,
   and
2) before that packet was processed, the ProxyIostate's handler ran and
   decided to destroy itself.

Bug: ZX-4060
Change-Id: I3b9c7275c4e0cd2dc3a6c6cd2d2376c947eb627a

This moves the ProxyIostate and ConnectionDestroyer types into their
own files, and feeds them async dispatchers via injection rather than
environmental globals.

Change-Id: Ifeadbed02e92a7e2a7af5346ddd253af74112abf

This restores most of the incidental improvements in the original commit
396d2162, while keeping logging silent.

This reverts commit 7f7e4ffb.

Change-Id: Ie8183448c8cddb03f0423287d67183b0a3658cf6

Bug: ZX-1751 #comment Full libc++ use now available in Zircon.
Change-Id: I3f2f7e2e9a8f81129d27374e6e396a75586f6774

Bug: ZX-1751 #comment Removed zxcpp from userland
Change-Id: Ic4fedc8e0c2362c1f26864629078cd86c6a59cac

Change-Id: I9e6b33b75a7e70485a7d125db1251823cc682c3f

This reverts commit cf254ae8.

Reason for revert: Causes vim2 to fail to pave. See: https://fuchsia.atlassian.net/browse/DNO-519

Original change's description:
> [devhost] Wait for BindDriver in reply to Bind
> 
> Calls to fuchsia.device.Controller/Bind should only return once the
> operation completes, which is when
> fuchsia.device.manager.DeviceController/BindDriver is called.
> 
> ZX-3991 #done
> 
> Change-Id: I10607640072c8f779ac1d5be79d5a2da6de6288b

TBR=kulakowski@google.com,teisenbe@google.com,abdulla@google.com,brettw@google.com

Change-Id: I370d03abd9fa93a70a48f86f4df171f2cf87ee12
No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Calls to fuchsia.device.Controller/Bind should only return once the
operation completes, which is when
fuchsia.device.manager.DeviceController/BindDriver is called.

ZX-3991 #done

Change-Id: I10607640072c8f779ac1d5be79d5a2da6de6288b

When devcoordinator comes online it prints an error message
if the root resource is not available, so it is unnecessary to
print that the resource is unavailable several tiems later on.

Change-Id: I0785840b53603a4495db286c1bf3495330e4b13f

Devfs should no longer call DirectoryOpen on devices except when opening
the device itself (i.e. with a path of ".").

This is a small change in behavior in that when the describe flag is set
devfs will now report ZX_ERR_NOT_FOUND when attempting to open a
nonexistant file under a device. Previously devmgr would simply close the
channel in this case.

Also remove the DirectoryOpen handler from devmgr.

Add an additional check to the devfs tests that opening a file under a
device path (i.e. /dev/<device>/<file>) fails with ZX_ERR_NOT_FOUND
unless the device has a child device (e.g. /dev/class/block/000).

Change-Id: If7f33ac306940da7e43ae8c5b53a15d907593042

Was originally submitted as Id411227e4c3d2b8add49978cf6ce1a76de509a48.

Startup a miscsvc binary, and provide a channel to it's '/svc/
directory to svchost, which will then forward it services.

To start miscsvc only implements the paver service.

ZX-3861

Change-Id: I83a630476c08d15e461d74e3321ad55bb21a3c2f

This change:

* splits //zircon/system/ulib/zxcrypt into two libraries, so that the
  FDIO dependencies don't leak into the driver, and vice versa
* reduces the set of dependencies of the driver to those actually
  required
* cuts out some transitive dependencies on libraries that are not used
  at all by dependencies of zxcrypt

Tests: added some assert_no_deps in the build, and checked the
dependencies of the new artifact:

(15:24:39) zarvox@zarvox-linux ~/fuchsia/out $ readelf -d ./default.zircon/user-x64-gcc.shlib/obj/system/dev/block/zxcrypt/zxcrypt.so | grep Shared
 0x0000000000000001 (NEEDED)             Shared library: [libzircon.so]
 0x0000000000000001 (NEEDED)             Shared library: [libdriver.so]
 0x0000000000000001 (NEEDED)             Shared library: [libc.so]

DNO-492 #comment zxcrypt.so links most things statically

Change-Id: Ic7d179ae77af6e1efbaa10624ecadcd8b27134f9

If the disk format is unknown but the GPT GUID values dictate that it
should be a data format, it determines if the volume should be a zxcrypt
or minfs partition and formats it as such.

Added a unit test that failed without the changes. I added a test that
would have caught the vim2 breakage, but I also manually tested that it
boots up properly.

Change-Id: I276d55fc8dbcc8377d6a6b7d5dfe7b0fd9019eb4

Make /dev/misc/dmctl not writeable, remove code handling string parsing.

Test: {Qemu, Frank}: "dm" handles invalid code, writing to dmctl does nothing.
Change-Id: I6d14ce37963dfd87ba6a12d2decb6ef1e0767dd5

This reverts commit 396d2162.

Reason for revert: we've gotten enough information on the bug that we were trying to investigate with this (DNO-492) that we no longer need this logging, and the excessive logging is causing people grief.

Original change's description:
> [fshost] log when encountering unknown disk format
> 
> DNO-492 #comment
> Tests: paved an Astro, saw this log reasonable content
> for the empty volumes before formatted, did not log after paved.
> 
> Change-Id: I07a80dc2a826e80ba5c12ca5901d460a65266153

TBR=smklein@google.com,abarth@google.com,zarvox@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Ifc296d88a00a9898cebd49980ffcfa409d45b0d0

This reverts commit 1423535d.

Reason for revert: OTA broke, this CL is a dependent on the change that breaks OTA

Original change's description:
> [svchost][devmgr][miscsvc] Add miscsvc
> 
> Startup a miscsvc binary, and provide a channel to it's '/svc/
> directory to svchost, which will then forward it services.
> 
> To start miscsvc only implements the paver service.
> 
> ZX-3861
> 
> Change-Id: Id411227e4c3d2b8add49978cf6ce1a76de509a48

TBR=teisenbe@google.com,abarth@google.com,shayba@google.com,surajmalhotra@google.com

Change-Id: I63906a5e8061fd2f5eb69bb5894533d6239127a2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Startup a miscsvc binary, and provide a channel to it's '/svc/
directory to svchost, which will then forward it services.

To start miscsvc only implements the paver service.

ZX-3861

Change-Id: Id411227e4c3d2b8add49978cf6ce1a76de509a48

Without this, the devfs path would include the composite bindpoint and
the topological path would not.  The topological path has been updated
to include it.

Change-Id: I8185ae93697bab90361eb6a29ba5c37cea82a1cc

Implement job policy ZX_POL_ACTION_KILL by calling
ProcessDispatcher::Kill from EnforceBasicPolicy.

Rename QueryBasicPolicy to EnforceBasicPolicy and tighten it by
marking as __WARN_UNUSED_RESULT.

Replace policy action bitfield with multiple choice.

Bug: ZX-3520 #comment done
Test: /boot/test/sys/policy-test
Change-Id: Ia6da570ebd8c4d81961f78d6ddcc643183f7c85c

The DirectoryOpen handler will be removed along with resulting changes
to devfs in a follow up CL.

Change-Id: I37df4c6bdf2aba84575a5ab6b692b2da5f362185

We suspect that something may be causing occasional deadlock around the
time that we attempt to bind the zxcrypt driver.  Add more logging, and
increase verbosity in a couple places to see if we can narrow down where
we're going awry.

DNO-492 #comment
TEST: no behavioral change, just more logging

Change-Id: Ib03af33da1d67533599c80e4453ef27dc160950e

This message gets output once per devhost during boot, and does not
provide useful diagnostic information.  This moves the message to the
SPEW level in case it is useful for debugging tracing support.

Change-Id: I373d585014c9c1d7b26e52629e44476a15a68e80

If a component was a device with MUST_ISOLATE set on it, we would try to
bind to the non-proxied side of it, which doesn't speak the device
protocols.

This is a re-landing of I64eaccec5d51997f4374d0277b040a952f681667.  The
change was reverted due to flakiness on ASAN builds.  The flakiness was
fixed in I7c6256d5f2a0af8922e85423ccb27330687182e6.

Change-Id: I8736ff598a764ef2d70bf7792019e3a749ad1eec

These are usually the same, but in the case of composite devices there
is a difference.

Change-Id: I7c6256d5f2a0af8922e85423ccb27330687182e6
Bug: ZX-3971 #done

We have already switched to using a more direct path to create virtcons,
this removes the old path through /dev/misc/dmctl to the devcoordinator.

Issue: ZX-3403
Test: Booted frank, virtcon still works, this change is in essence a
no-op as nothing is using this code.

Change-Id: Icb0b77984a818a56f98d5099d111878e9f88ea57

DNO-492 #comment
Tests: paved an Astro, saw this log reasonable content
for the empty volumes before formatted, did not log after paved.

Change-Id: I07a80dc2a826e80ba5c12ca5901d460a65266153

Additionally, some minor related changes:
- Remove unused "FormatMinfs" function.
- Plumb the "Should we check filesystems?" boolean through explicit
arguments instead of environment variables.
- Make minfs superblock validation more strict. This validates that
clients can't format a filesystem with N blocks, and either mount
of check the consistency of a filesystem with M blocks, for M < N.
This change, along with the fshost tests, acts as a regression for
a bug where the consistency checker only inspected a subsection of the
filesystem.

Change-Id: I15470e9529553526011c8fba2d8a6f5987b8e1a6

Create an abstract "BlockDeviceInterface" class, and
add unit tests for it.

Change-Id: Ie61268a11a217a27e23fabfbdd5873d01e734a8a

This object isn't actually doing any watching; it's just holding
filesystem state including "FsManager".

Change-Id: Ia7e79f161d52680e6a0f71d77995712efe6460a6

No functionality added in this patch; just a refactor
to distinguish the "observing block device" component of
block watcher from the "filesystem launching" component
of block watcher.

Change-Id: I66f909f66ba3edaef6cda28183ed7d5fe52be998

This reverts commit 2dcfdba2.

Reason for revert: Failed boot on vim2

Original change's description:
> [zircon] Reformat zxcrypt and minfs partitions when the partition is
> missing. Added a unit test that failed without the changes.
>
> Change-Id: Idaf9913bf9006384e021f39047df1e8e8a855369

TBR=smklein@google.com,aarongreen@google.com,abarth@google.com,zarvox@google.com,jseibert@google.com

Change-Id: I0e755d84dc4839e8968308ca753aa1d9c9c5038b

The old - names were only ever used because of limitations of the
old Zircon build system, which is no longer an issue.  The target
name in banjo_library() must always match the library name.  For
public Banjo libraries, the directory name matches that name too.

Change-Id: Ifff61436ec7d15eb53dfd21349c4367047e691d4

This reverts commit 75b35cea.

Reason for revert: This CL is a suspect for the currently red fuchsia-roller;  it fails the /boot/test/ddk/platform-bus-test test.

Original change's description:
> [devcoordinator] Fix buggy composite device behavior
>
> If a component was a device with MUST_ISOLATE set on it, we would try to
> bind to the non-proxied side of it, which doesn't speak the device
> protocols.
>
> Change-Id: I64eaccec5d51997f4374d0277b040a952f681667

TBR=teisenbe@google.com,abarth@google.com,jocelyndang@google.com

Change-Id: Id9d48682336ea648599cfead60444c5074c4ae1e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true

If a component was a device with MUST_ISOLATE set on it, we would try to
bind to the non-proxied side of it, which doesn't speak the device
protocols.

Change-Id: I64eaccec5d51997f4374d0277b040a952f681667

missing. Added a unit test that failed without the changes.

Change-Id: Idaf9913bf9006384e021f39047df1e8e8a855369

This reduces the externally and internally mutable surface of the datastructure

Change-Id: I26f045a62cfa2bd78c3c02a65ee0c4b062f9c6f3

This method has been deprecated for a while and is now unused.

Bug: ZX-2620 #done
Change-Id: I742ca8299a598000b34aaee17c2493a441db6076

Transition is complete. This change removes the temporary methods
rea2 and rea2_etc. Also transitions a missed and a new caller.

Test: CQ

Bug: ZX-2812
Change-Id: I70f87de74df2b863fbcf35df08643f098c6d516b

Verified that this test fails without
I4f8ae59764dab9883c9fad4d6b085298cfd40dc3 and
I2a6cdda90a3ba0b111dbba650621d2c1b71ea60a

Change-Id: I741313b247c70286973a72a81fee56f69c73f747

With this patch, suspending of a composite device should work.

Change-Id: I2a6cdda90a3ba0b111dbba650621d2c1b71ea60a