- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Merge r257633:

- Add manual pages for capability rights (rights(4)), cap_rights_init(3)
family of functions and cap_rights_get(3) function.
- Update remaining Capsicum-related manual pages.

Sponsored by: The FreeBSD Foundation
Reviewed by: bdrewery
Approved by: re (glebius)

Merge r256537 from head:
Make getutxent(3) more robust against bad utx.log files. Whenever we read
zeroes, don't stop processing the file, but read until its end or valid
data.

In collaboration with: ed

Approved by: re (kib)

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Consistently reference file descriptors as "fd". 55 other manpages
used "fd", while these used "d" and "filedes".

MFC after: 1 week
Approved by: gjb
Approved by: re (delphij)

Document SIGLIBRT in signal(3); take a stab at the signal description as
the original committer didn't provide one.

MFC after: 3 days

libc: Always use our own copy of sys_errlist and sys_nerr (.so only).

This ensures strerror() and friends continue to work correctly even if a
(non-PIE) executable linked against an older libc imports sys_errlist (which
causes sys_errlist to refer to the executable's copy with a size fixed when
that executable was linked).

The executable's use of sys_errlist remains broken because it uses the
current value of sys_nerr and may access past the bounds of the array.

Different from the message "Using sys_errlist from executables is not
ABI-stable" on freebsd-arch, this change does not affect the static library.
There seems no reason to prevent overriding the error messages in the static
library.

wordexp(): Avoid leaking the pipe file descriptors to a parallel fork/exec.

This uses the new pipe2() system call added on May 1 (r250159).

Expand the use of stat(2) flags to allow storing some Windows/DOS
and CIFS file attributes as BSD stat(2) flags.

This work is intended to be compatible with ZFS, the Solaris CIFS
server's interaction with ZFS, somewhat compatible with MacOS X,
and of course compatible with Windows.

The Windows attributes that are implemented were chosen based on
the attributes that ZFS already supports.

The summary of the flags is as follows:

UF_SYSTEM: Command line name: "system" or "usystem"
ZFS name: XAT_SYSTEM, ZFS_SYSTEM
Windows: FILE_ATTRIBUTE_SYSTEM

This flag means that the file is used by the
operating system. FreeBSD does not enforce any
special handling when this flag is set.

UF_SPARSE: Command line name: "sparse" or "usparse"
ZFS name: XAT_SPARSE, ZFS_SPARSE
Windows: FILE_ATTRIBUTE_SPARSE_FILE

This flag means that the file is sparse. Although
ZFS may modify this in some situations, there is
not generally any special handling for this flag.

UF_OFFLINE: Command line name: "offline" or "uoffline"
ZFS name: XAT_OFFLINE, ZFS_OFFLINE
Windows: FILE_ATTRIBUTE_OFFLINE

This flag means that the file has been moved to
offline storage. FreeBSD does not have any special
handling for this flag.

UF_REPARSE: Command line name: "reparse" or "ureparse"
ZFS name: XAT_REPARSE, ZFS_REPARSE
Windows: FILE_ATTRIBUTE_REPARSE_POINT

This flag means that the file is a Windows reparse
point. ZFS has special handling code for reparse
points, but we don't currently have the other
supporting infrastructure for them.

UF_HIDDEN: Command line name: "hidden" or "uhidden"
ZFS name: XAT_HIDDEN, ZFS_HIDDEN
Windows: FILE_ATTRIBUTE_HIDDEN

This flag means that the file may be excluded from
a directory listing if the application honors it.
FreeBSD has no special handling for this flag.

The name and bit definition for UF_HIDDEN are
identical to the definition in MacOS X.

UF_READONLY: Command line name: "urdonly", "rdonly", "readonly"
ZFS name: XAT_READONLY, ZFS_READONLY
Windows: FILE_ATTRIBUTE_READONLY

This flag means that the file may not written or
appended, but its attributes may be changed.

ZFS currently enforces this flag, but Illumos
developers have discussed disabling enforcement.

The behavior of this flag is different than MacOS X.
MacOS X uses UF_IMMUTABLE to represent the DOS
readonly permission, but that flag has a stronger
meaning than the semantics of DOS readonly permissions.

UF_ARCHIVE: Command line name: "uarch", "uarchive"
ZFS_NAME: XAT_ARCHIVE, ZFS_ARCHIVE
Windows name: FILE_ATTRIBUTE_ARCHIVE

The UF_ARCHIVED flag means that the file has changed and
needs to be archived. The meaning is same as
the Windows FILE_ATTRIBUTE_ARCHIVE attribute, and
the ZFS XAT_ARCHIVE and ZFS_ARCHIVE attribute.

msdosfs and ZFS have special handling for this flag.
i.e. they will set it when the file changes.

sys/param.h: Bump __FreeBSD_version to 1000047 for the
addition of new stat(2) flags.

chflags.1: Document the new command line flag names
(e.g. "system", "hidden") available to the
user.

ls.1: Reference chflags(1) for a list of file flags
and their meanings.

strtofflags.c: Implement the mapping between the new
command line flag names and new stat(2)
flags.

chflags.2: Document all of the new stat(2) flags, and
explain the intended behavior in a little
more detail. Explain how they map to
Windows file attributes.

Different filesystems behave differently
with respect to flags, so warn the
application developer to take care when
using them.

zfs_vnops.c: Add support for getting and setting the
UF_ARCHIVE, UF_READONLY, UF_SYSTEM, UF_HIDDEN,
UF_REPARSE, UF_OFFLINE, and UF_SPARSE flags.

All of these flags are implemented using
attributes that ZFS already supports, so
the on-disk format has not changed.

ZFS currently doesn't allow setting the
UF_REPARSE flag, and we don't really have
the other infrastructure to support reparse
points.

msdosfs_denode.c,
msdosfs_vnops.c: Add support for getting and setting
UF_HIDDEN, UF_SYSTEM and UF_READONLY
in MSDOSFS.

It supported SF_ARCHIVED, but this has been
changed to be UF_ARCHIVE, which has the same
semantics as the DOS archive attribute instead
of inverse semantics like SF_ARCHIVED.

After discussion with Bruce Evans, change
several things in the msdosfs behavior:

Use UF_READONLY to indicate whether a file
is writeable instead of file permissions, but
don't actually enforce it.

Refuse to change attributes on the root
directory, because it is special in FAT
filesystems, but allow most other attribute
changes on directories.

Don't set the archive attribute on a directory
when its modification time is updated.
Windows and DOS don't set the archive attribute
in that scenario, so we are now bug-for-bug
compatible.

smbfs_node.c,
smbfs_vnops.c: Add support for UF_HIDDEN, UF_SYSTEM,
UF_READONLY and UF_ARCHIVE in SMBFS.

This is similar to changes that Apple has
made in their version of SMBFS (as of
smb-583.8, posted on opensource.apple.com),
but not quite the same.

We map SMB_FA_READONLY to UF_READONLY,
because UF_READONLY is intended to match
the semantics of the DOS readonly flag.
The MacOS X code maps both UF_IMMUTABLE
and SF_IMMUTABLE to SMB_FA_READONLY, but
the immutable flags have stronger meaning
than the DOS readonly bit.

stat.h: Add definitions for UF_SYSTEM, UF_SPARSE,
UF_OFFLINE, UF_REPARSE, UF_ARCHIVE, UF_READONLY
and UF_HIDDEN.

The definition of UF_HIDDEN is the same as
the MacOS X definition.

Add commented-out definitions of
UF_COMPRESSED and UF_TRACKED. They are
defined in MacOS X (as of 10.8.2), but we
do not implement them (yet).

ufs_vnops.c: Add support for getting and setting
UF_ARCHIVE, UF_HIDDEN, UF_OFFLINE, UF_READONLY,
UF_REPARSE, UF_SPARSE, and UF_SYSTEM in UFS.
Alphabetize the flags that are supported.

These new flags are only stored, UFS does
not take any action if the flag is set.

Sponsored by: Spectra Logic
Reviewed by: bde (earlier version)

Implement fdclosedir(3) function, which is equivalent to the closedir(3)
function, but returns directory file descriptor instead of closing it.

Submitted by: Mariusz Zaborski <oshogbo@FreeBSD.org>
Sponsored by: Google Summer of Code 2013

Remove redundant space.

dup3(3): Replace copyright notice.

Although I copied dup(2) to create dup3(3), I removed almost all the
non-boilerplate, so dup3(3) is copyright me.

Reported by: bjk

libc: Access _logname_valid more efficiently.

The variable _logname_valid is not exported via the version script;
therefore, change C and i386/amd64 assembler code to remove indirection
(which allowed interposition). This makes the code slightly smaller and
faster.

Also, remove #define PIC_GOT from i386/amd64 in !PIC mode. Without PIC,
there is no place containing the address of each variable, so there is no
possible definition for PIC_GOT.

Add man page dup3(3).

Add dup3(), based on F_DUP2FD and F_DUP2FD_CLOEXEC fcntls.

I removed functionality not proposed for POSIX in Austin group issue #411.
A man page (my own) and test cases will follow in later commits.

PR: 176233
Submitted by: Jukka Ukkonen

According to POSIX \ in the fnmatch(3) pattern should escape
any character including '\0', but our version replace escaped '\0'
with '\\'.
I.e. fnmatch("\\", "\\", 0) should not match while fnmatch("\\", "", 0)
should (Linux and NetBSD does the same). Was vice versa.

PR: 181129
MFC after: 1 week

Remove define and documentation for vm_pageout_algorithm missed in r253587

wordexp(): Fix syntax validation for backslashes in single-quotes.

Fix mdoc syntax.

Pointed out by: joeld

Add a leaf node CTL_NET.PF_ROUTE.0.AF.NET_RT_DUMP.0.FIB. This returns
routing table with the specified FIB number, not td->td_proc->p_fibnum.

libc: Access _sigintr more efficiently.

The variable _sigintr is not exported via the version script; therefore,
tell the compiler that no indirection (to allow interposition) is needed.

mdoc: convert .Fd to .In, which is much nicer.

Remove the advertising clause from the Regents of the University of
California's license, per the letter dated July 22, 1999.

The getcontext() from the __fillcontextx() call in the
check_deferred_signal() returns twice, since handle_signal() emulates
the return from the normal signal handler by sigreturn(2)ing the
passed context. Second return is performed on the destroyed stack
frame, because __fillcontextx() has already returned. This causes
undefined and bad behaviour, usually the victim thread gets SIGSEGV.

Avoid nested frame and the need to return from it by doing direct call
to getcontext() in the check_deferred_signal() and using a new private
libc helper __fillcontextx2() to complement the context with the
extended CPU state if the deferred signal is still present.

The __fillcontextx() is now unused, but is kept to allow older
libthr.so to be used with the new libc.

Mark __fillcontextx() as returning twice [1].

Reported by: pgj
Pointy hat to: kib
Discussed with: dim
Tested by: pgj, dim
Suggested by: jilles [1]
MFC after: 1 week

Update manpages for r250887.

Remove the lists of unneeded header files.

Requested by: eadler

popen(): Add 'e' mode character to set close-on-exec on the new fd.

If 'e' is used, the kernel must support the recently added pipe2() system
call.

The use of pipe2() with O_CLOEXEC also fixes race conditions between
concurrent popen() calls from different threads, even if the close-on-exec
flag on the fd of the returned FILE is later cleared (because popen() closes
all file descriptors from earlier popen() calls in the child process).
Therefore, this approach should be used in all cases when pipe2() can be
assumed present.

The old version of popen() rejects "re" and "we" but treats "r+e" like "r+".

Typo.

posix_spawn_file_actions_adddup2(3): Document difference with dup2().

The ability to clear a file descriptor's close-on-exec flag via
posix_spawn_file_actions_adddup2() is in fact proposed in Austin Group issue
#411.

MFC after: 1 week

posix_spawn_file_actions_addopen(3): Correct error for bad file descriptor.

As per POSIX.1-2008, posix_spawn_file_actions_add* return [EBADF] if a file
descriptor is negative, not [EINVAL]. The bug was only in the manual page;
the code is correct.

MFC after: 1 week

wordexp(): Simplify code by deferring work to sh.

POSIX 1003.1-2008: add ENOTRECOVERABLE, EOWNERDEAD errnos.

sysconf(3): Correct the description of _SC_OPEN_MAX.

Reported by: bde
MFC after: 1 week

- sl_find does not modify 'name'
- make the prototype of sl_find match NetBSD

Reviewed by: jilles
Approved by: cperciva (mentor)
MFC After: 3 days

Switch from K&R prototypes to modern C

Reviewed by: jilles
Approved by: cperciva (mentor)
MFC After: 3 days

pututxline: Don't set errno=0 in subfunctions.

The functions utx_active_add(), utx_active_remove(), utx_lastlogin_add() and
utx_log_add() set errno to 0 if they are successful. This not only violates
POSIX if pututxline() is successful, but may also overwrite a valid error
with 0 if, for example, utx_lastlogin_add() fails while utx_log_add()
succeeds.

Reviewed by: ed

mdoc: remove superfluous paragraph macro.

- Document that sem_wait() can fail with EINTR if it is interrupted by a
signal.
- Fix the old ksem implementation for POSIX semaphores to not restart
sem_wait() or sem_timedwait() if interrupted by a signal.

MFC after: 1 week

Spelling correction

wordexp(): Remove wrong IFS usage.

Words in shell script are separated by spaces or tabs independent of the
value of IFS. The value of IFS is only relevant for the result of
substitutions. Therefore, there should be a space between 'wordexp' and the
words to be expanded, not an IFS character.

Paranoia might dictate that the shell ignore IFS from the environment (even
though our sh currently uses it), so do not depend on it in the new test
case.

Update to the latest (un)vis(3) sources from NetBSD. This adds
multibyte support[0] and the new functions strenvisx and strsenvisx.

Add MLINKS for vis(3) functions add by this and the initial import from
NetBSD[1].

PR: bin/166364, bin/175418
Submitted by: "J.R. Oldroyd" <fbsd@opal.com>[0]
stefanf[1]
Obtained from: NetBSD
MFC after: 2 weeks

Link getcontextx(3) to getcontext(3).

Reviewed by: kib
MFC after: 1 week

Add the getcontextx prototype to SYNOPSIS.

Reviewed by: kib
MFC after: 1 week

Provide cap_sandboxed(3) function, which is a wrapper around cap_getmode(2)
system call, which has a nice property - it never fails, so it is a bit
easier to use. If there is no support for capability mode in the kernel
the function will return false (not in a sandbox). If the kernel is compiled
with the support for capability mode, the function will return true or false
depending if the calling process is in the capability mode sandbox or not
respectively.

Sponsored by: The FreeBSD Foundation

libc/opendir: Improve behaviour of union uniquifier:

* Reopen the directory using openat(fd, ".", ...) instead of opening the
pathname again. This fixes a race condition where the meaning of the
pathname changes and allows a reopen with fdopendir().
* Always reopen the directory for union stacks, not only when DTF_REWIND
is passed. Applications should be able to fchdir(dirfd(dir)) and
*at(dirfd(dir), ...). DTF_REWIND now does nothing.

Make more code be protected by internal mutex, and now it is fork-safe, in
error case, the file exclusive lock is now released as soon as possible,
in previous code, child process can still hold the exclusive lock.

Put one file per line so it is easier to read diffs against those files.

Simplify code by using flag O_EXLOCK.

PR: kern/175674

fts: Use O_DIRECTORY when opening name that might be changed by attacker.

There are uncommon cases where fts_safe_changedir() may be called with a
non-NULL name that is not "..". Do not block or worse if an attacker put (a
(symlink to) a fifo or device where a directory used to be.

MFC after: 1 week

Add contrib/libc-vis to the include path so we reliably pick up the right
version of vis.h.

Reported by: dim

In r244401 I accidently moved strunvis and strunvisx from version 1.0 to
1.3 breaking the libc ABI. Revert that change (breaking the ABI again
for users who updated after December 18th).

- Reduce buffer size from LINE_MAX to PATH_MAX, there is no point to store
path longer than this.
- Fix an unreached case of check against sizeof buf, which in turn leads
to an off-by-one nul byte write on the stack. The original condition
can never be satisfied because the passed boundary is the maximum value
that can be returned, so code was harmless.

MFC after: 1 month

Replace our implementation of the vis(3) and unvis(3) APIs with
NetBSD's. This output size limited versions of vis and unvis functions
as well as a set of vis variants that allow arbitrary characters to be
specified for encoding.

Finally, MIME Quoted-Printable encoding as described in RFC 2045 is
supported.

Eliminate redundant variable.

libc: Make various internal file descriptors close-on-exec.

These are obtained via fopen().

libc: Use the new 'e' fopen() mode option to simplify fstab.c.

No functional change is intended.

Protect against DoS attacks, such as being described in CVE-2010-2632.
The changes were derived from what has been committed to NetBSD, with
modifications. These are:
1. Preserve the existsing GLOB_LIMIT behaviour by including the number
of matches to the set of parameters to limit.
2. Change some of the limits to avoid impacting normal use cases:
GLOB_LIMIT_STRING - change from 65536 to ARG_MAX so that glob(3)
can still provide a full command line of expanded names.
GLOB_LIMIT_STAT - change from 128 to 1024 for no other reason than
that 128 feels too low (it's not a limit that impacts the
behaviour of the test program listed in CVE-2010-2632).
GLOB_LIMIT_PATH - change from 1024 to 65536 so that glob(3) can
still provide a fill command line of expanded names.
3. Protect against buffer overruns when we hit the GLOB_LIMIT_STAT or
GLOB_LIMIT_READDIR limits. We append SEP and EOS to pathend in
those cases. Return GLOB_ABORTED instead of GLOB_NOSPACE when we
would otherwise overrun the buffer.

This change also modifies the existing behaviour of glob(3) in case
GLOB_LIMIT is specifies by limiting the *new* matches and not all
matches. This is an important distinction when GLOB_APPEND is set or
when the caller uses a non-zero gl_offs. Previously pre-existing
matches or the value of gl_offs would be counted in the number of
matches even though the man page states that glob(3) would return
GLOB_NOSPACE when gl_matchc or more matches were found.

The limits that cannot be circumvented are GLOB_LIMIT_STRING and
GLOB_LIMIT_PATH all others can be crossed by simply calling glob(3)
again and with GLOB_APPEND set.

The entire description above applies only when GLOB_LIMIT has been
specified of course. No limits apply when this flag isn't set!

Obtained from: Juniper Networks, Inc

In globextend(), take advantage of the fact that realloc(NULL, size) is
equivalent to malloc(size). This eliminates the conditional expression
used for calling either realloc() or malloc() when realloc() will do
all the time.

In globextend() when the pathv vector cannot be (re-)allocated, don't
free and clear the gl_pathv pointer in the glob_t structure. Such
breaks the invariant of the glob_t structure, as stated in the comment
right in front of the globextend() function. If gl_pathv was non-NULL,
then gl_pathc was > 0. Making gl_pathv a NULL pointer without also
setting gl_pathc to 0 is wrong.

Since we otherwise don't free the memory associated with a glob_t in
error cases, it's unlikely that this change will cause a memory leak
that wasn't already there to begin with. Callers of glob(3) must
call globfree(3) irrespective of whether glob(3) returned an error
or not.

mdoc: Use the Ev macro for environmental variables.

Complete man page.

MFC after: 2 weeks

Implement the waitid() SUSv4 function using wait6() system call.

PR: standards/170346
Submitted by: "Jukka A. Ukkonen" <jau@iki.fi>
MFC after: 1 month

Add an explanatory comment to lib/libc/gen/isnan.c about the fix to make
static linking with libc and libm work.

Requested by: jilles
MFC after: 1 week
X-MFC-With: 242879

Only define isnan, isnanf, __isnan and __isnanf in libc.so, not in
libc.a and libc_p.a. In addition, define isnan in libm.a and libm_p.a,
but not in libm.so.

This makes it possible to statically link executables using both isnan
and isnanf with libc and libm.

Tested by: kargl
MFC after: 1 week

Replace our version of the pwcache(3) API with NetBSD's implementation.

This adds two features:
* uid_from_user() and gid_from_group() as the reverse of user_from_uid()
and groups_from_gid().
* pwcache_userdb() and pwcache_groupdb() which allow alternative lookup
functions to be used. For example lookups from passwd and group
databases in a non-standard location.

Fix my last commit. Only call strunvis after properly checking the argument is
not NULL.

Decode the first two fstab fields with strunvis(3). This allows having spaces
in devices and mount paths, encoded as \s or \040.

PR: bin/117687
Submitted by: Martin Kammerhofer
Discussed on: arch

Apply some style. Checked with md5.

libc: Use O_CLOEXEC for various internal file descriptors.

This fixes a race condition where another thread may fork() before CLOEXEC
is set, unintentionally passing the descriptor to the child process.

This commit only adds O_CLOEXEC flags to open() or openat() calls where no
fcntl(fd, F_SETFD, FD_CLOEXEC) follows. The separate fcntl() call still
leaves a race window so it should be fixed later.

libc/fts: Use O_CLOEXEC for internal file descriptors.

Because fts keeps internal file descriptors open across calls, making such
descriptors close-on-exec helps not only multi-threaded applications but
also single-threaded applications.

In particular, this prevents passing a temporary file descriptor for saving
the current directory to processes created via find -exec.

Add the same warning to rand48(3) as to rand(3) and random(3).

MFC after: 3 days

Avoid segfault if name is invalid. Basically, only
check for CTL_USER if the sysctl fails with ENOENT.

PR: 169056
Reviewed by: jhb

Remove trailing whitespace.

Add manual pages for clock_getcpuclockid and pthread_getcpuclockid.

Fix prototype. Also the function should return error code instead of
-1 on error.

Implement syscall clock_getcpuclockid2, so we can get a clock id
for process, thread or others we want to support.
Use the syscall to implement POSIX API clock_getcpuclock and
pthread_getcpuclockid.

PR: 168417

Rename aux.c to auxv.c.

On Windows, AUX is the auxiliary device, usually pointing to COM1.
Therefore it is forbidden to create a file named aux.c. To make it a bit
easier for Windows users to check out our source code, rename this file
to auxv.c.

MFC after: 1 month
Discussed with: kib
Suggested by: Eric van Gyzen <eric vangyzen net>

nftw(): POSIX says directories causing loops should be silently skipped.

Formerly, loops caused nftw() to abort the traversal with ELOOP.

Refresh with OpenBSD RCS ID changes to reflect that we now have essentionally
the same file.

ftw(): Do not check the maxfds argument against OPEN_MAX.

Apart from the fact that nothing should have OPEN_MAX as a limit (as opposed
to RLIMIT_NOFILE from getrlimit() or _SC_OPEN_MAX from sysconf()), POSIX
does not require us to check this. POSIX does have a requirement on the
application that maxfds not exceed {OPEN_MAX}, but does not require the
implementation to check it ("may fail").

PR: 95239

nftw(): Do not check the maxfds argument against OPEN_MAX.

Apart from the fact that nothing should have OPEN_MAX as a limit (as opposed
to RLIMIT_NOFILE from getrlimit() or _SC_OPEN_MAX from sysconf()), POSIX
does not require us to check this.

PR: 95239
Submitted by: Todd Miller

Use calloc().

Document the behavior (from 4.4-lite) that tokens returned by telldir() are
single use.

Sponsored by: DARPA, AFRL
MFC after: 3 days

Prefer sysctl to open/read/close for obtaining random data.
This method is more sandbox-friendly and also should be faster as only
one syscall is needed instead of three.
In case of an error fall back to the old method.

Reviewed by: simon, gleb
MFC after: 2 weeks

Optimize the handling of SC_NPROCESSORS_CONF, by using auxv AT_NCPU
value if present.

MFC after: 1 week

Remove the assert added in r237286
The use of assertions in libraries is not widely accepted.

Requested by: bde, scottl
Approved by: cperciva
MFC after: 3 days
X-MFC-With: r237286

Use struct vdso_timehands data to implement fast gettimeofday(2) and
clock_gettime(2) functions if supported. The speedup seen in
microbenchmarks is in range 4x-7x depending on the hardware.

Only amd64 and i386 architectures are supported. Libc uses rdtsc and
kernel data to calculate current time, if enabled by kernel.

Hopefully, this code is going to migrate into vdso in some future.

Discussed with: bde
Reviewed by: jhb
Tested by: flo
MFC after: 1 month

Don't close an uninitialized descriptor. [1]
Add a sanity check for the validity of the passed fd.

PR: kern/139080 [1]
Submitted by: Andrey Simonenko <simon@comsys.ntu-kpi.kiev.ua> [1]
Reviewed by: pjd (briefly)
Approved by: cperciva
MFC after: 1 week

More style.

MFC after: 3 days

Revert part of the r235740 which changed separate allocation of the
string buffer for each linelist l_line into one large string. Since
linelists parsed out during the previous passes store the pointers to
previously allocated l_lines, the reallocation caused undefined
behaviour on accessing the buffers, and quite deterministic fault on
freeing them (in mountd(8) startup).

This fixes reading of netgroup(5) file which contains more then one
netgroup.

Discussed with: ghelmer
MFC after: 3 days

mandoc fixes.

Obtained from: OpenBSD

Make sure that fstab fd is not leaked on exec.

PR: kern/169023
Submitted by: Jukka Ukkonen <jau iki fi>
MFC after: 1 week

mdoc: minor Bl improvements.

Style(9) improvements: remove unnecessary parenthesis, improve order
of local variable declarations, remove bogus casts, and resolve long
lines.

Reviewed by: bde

Add checks for memory allocation failures in appropriate places, and
avoid creating bad entries in the grp list as a result of memory allocation
failures while building new entries.

PR: bin/83340
Reviewed by: delphij (prior version of patch)

Apply style(9) to return and switch/case statements.

Reviewed by: delphij (prior version of the patch)

Put my name as copyright owner of lib/libc/gen/dirfd.c added in r235647.

Requested by: kib@

Hide DIR definition by making it an opaque struct typedef.

Introduce dirfd() libc exported symbol replacing macro with same name,
preserve _dirfd() macro for internal use.

Replace dirp->dd_fd with dirfd() call. Avoid using dirfd as variable
name to prevent shadowing global symbol.

Sponsored by: Google Summer Of Code 2011

Use the .Bx macro instead of BSD

Submitted by: ru
Approved by: ru
MFC after: 3 days
X-MFC-With: r234700

Document the standardization status of err* and warn*

PR: docs/164939
Submitted by: Niclas Zeising <zeising@daemonic.se>
Approved by: bcr
MFC after: 3 days

Import jemalloc a8f8d7540d66ddee7337db80c92890916e1063ca (dev branch,
prior to 3.0.0 release). This fixes several bugs related to memory
initialization.

Mangle __jemalloc_a0{malloc,calloc,free}() just like all the other
library-internal symbols in jemalloc, and adjust the tls allocation code
in libc to use the mangled names.

Import jemalloc 9ef7f5dc34ff02f50d401e41c8d9a4a928e7c2aa (dev branch,
prior to 3.0.0 release) as contrib/jemalloc, and integrate it into libc.
The code being imported by this commit diverged from
lib/libc/stdlib/malloc.c in March 2010, which means that a portion of
the jemalloc 1.0.0 ChangeLog entries are relevant, as are the entries
for all subsequent releases.

sem_open: Make sure to fail an O_CREAT|O_EXCL open, even if that semaphore
is already open in this process.

If the named semaphore is already open, sem_open() only increments a
reference count and did not take the flags into account (which otherwise
happens by passing them to open()). Add an extra check for O_CREAT|O_EXCL.

PR: kern/166706
Reviewed by: davidxu
MFC after: 10 days

In sem_post, the field _has_waiters is no longer used, because some
application destroys semaphore after sem_wait returns. Just enter
kernel to wake up sleeping threads, only update _has_waiters if
it is safe. While here, check if the value exceed SEM_VALUE_MAX and
return EOVERFLOW if this is true.

Remove trailing whitespace per mdoc lint warning

Disussed with: gavin
No objection from: doc
Approved by: joel
MFC after: 3 days

mdoc: terminate quoted strings.

Reviewed by: brueffer

Make utmpx(3) thread safe if we support TLS.

Because the utmpx interface is generally not required to be thread-safe,
but it is nice to have, if easy to do so. Therefore don't make a mess
out of the code and only use it if __NO_TLS is not defined.

Fix style. Somehow I managed to lost a space when copy&paste.

Pointed out by: stefanf

Prevent fs_file NULL pointer dereference in fixfsfile() uncovered after r1.5
when passing damaged user-supplied fstab file data.

MFC after: 1 week

Revert previous change. It is an incomplete change from old branch. :-(

Use version 2 of semaphore provided by kernel umtx code, now if there is
no waiters, we still increase and decrease count in user mode without
entering kernel, once there is a waiter, sem_post will enter kernel to
increase count and wake thread up, this is atomicy and allow us to
gracefully destroy semaphore after sem_wait returned.

fts(3): Mention that FTS_NOCHDIR imposes {PATH_MAX} limits on the returned
pathnames.

With the current API (no *at functions), FTS_NOCHDIR requires that the
fts_accpath start with the original path passed to fts_open(); therefore,
the depth that can be reached is limited by the {PATH_MAX} constraint on
this pathname.

MFC after: 1 week

fts(3): Document cases where FTS_NOCHDIR is set implicitly.

PR: docs/166091
Submitted by: Matthew Story
MFC after: 1 week

- Switch ARM and MIPS to TLS Variant I
- Fix TLS allocation for Variant I: both rtld and libc allocators
assume that tls_static_space includes space for TLS structure.
So increment calculated static size by the size of it.

Removed excessive _seekdir() call in closedir(). This saves one lseek()
syscall. Before r5958, seekdir() was called for its side effect of
freeing memory allocated by opendir() for rewinddir(), but that revision
added _reclaim_telldir() that frees all memory allocated by telldir()
calls, making this call redundant.

This introduces a slight change. If an application duplicated the descriptor
obtained through dirfd(), it can no longer rely on file position to be
reset to the start of file after a call to closedir(). It's believed to
be safe because neither POSIX, nor any other OS I've tested (NetBSD, Linux,
OS X) rewind the file offset pointer on closedir().

Reported by: Igor Sysoev

Belatedly add dl_iterate_phdr(3) to the list of installed manpages.

MFC after: 3 days

Finally removed the stat() and fstat() calls from the opendir() code.
They were made excessive in r205424 by opening with O_DIRECTORY.
Also eliminated the fcntl() call used to set FD_CLOEXEC by opening
with O_CLOEXEC.

(fdopendir() still checks that the passed descriptor is a directory,
and sets FD_CLOEXEC on it.)

Reviewed by: ed

In revision 231989, we pass a 16-bit clock ID into kernel, however
according to POSIX document, the clock ID may be dynamically allocated,
it unlikely will be in 64K forever. To make it future compatible, we
pack all timeout information into a new structure called _umtx_time, and
use fourth argument as a size indication, a zero means it is old code
using timespec as timeout value, but the new structure also includes flags
and a clock ID, so the size argument is different than before, and it is
non-zero. With this change, it is possible that a thread can sleep
on any supported clock, though current kernel code does not have such a
POSIX clock driver system.

libc: Eliminate some relative relocations in fmtmsg().

Document the fact that getgrouplist(3) returns 0 on success.

MFC after: 3 days

Use ANSI prototypes.

Fix cross-references.

Submitted by: pluknet
MFC after: 2 weeks

Document dl_iterate_phdr(3).

Man page is based on the OpenBSD version, extended and corrected for
the FreeBSD implementation.

MFC after: 2 weeks

Fetch the aux vector for the static libc, and use the entries to
initialize the cache of the system information as it was done for the
dynamic libc. This removes several sysctls from the static binary
startup.

Use the aux vector to fill the single struct dl_phdr_info describing
the static binary itself, to implement dl_iterate_phdr(3) for the
static binaries. [1]

Based on the submission by: John Marino <draco marino st> [1]
Tested by: flo (sparc64)
MFC after: 2 weeks

Globally replace u_int*_t from (non-contributed) man pages.

The reasoning behind this, is that if we are consistent in our
documentation about the uint*_t stuff, people will be less tempted to
write new code that uses the non-standard types.

I am not going to bump the man page dates, as these changes can be
considered style nits. The meaning of the man pages is unaffected.

MFC after: 1 month

Replace utxrm(8) by utx(8).

At first, I added a utility called utxrm(8) to remove stale entries from
the user accounting database. It seems there are cases in which we need
to perform different operations on the database as well. Simply rename
utxrm(8) to utx(8) and place the old code under the "rm" command.

In addition to "rm", this tool supports "boot" and "shutdown", which are
going to be used by an rc-script which I am going to commit separately.

Set read buffer size to multiple of sizeof(struct futx).

If the utmpx database gets updated while an application is reading it,
there is a chance the reading application processes partially
overwritten entries. To solve this, make sure we always read a multiple
of sizeof(struct futx) at a time.

MFC after: 2 weeks

Introduce a new NET_RT_IFLISTL API to query the address list. It works
on extended and extensible structs if_msghdrl and ifa_msghdrl. This
will allow us to extend both the msghdrl structs and eventually if_data
in the future without breaking the ABI.

Bump __FreeBSD_version to allow ports to more easily detect the new API.

Reviewed by: glebius, brooks
MFC after: 3 days

More accurately document what happens on error.

PR: docs/127908
Submitted by: Matthew D. Fuller <fullermd@over-yonder.net>
Approved by: cperciva
MFC after: 1 week

Add API for obtaining extended machine context states that cannot be
fit into existing mcontext_t.

On i386 and amd64 do return the extended FPU states using
getcontextx(3). For other architectures, getcontextx(3) returns the
same information as getcontext(2).

Tested by: pho
MFC after: 1 month

Insert read memory barriers.

Remove wtmpcvt(1).

The wtmpcvt(1) utility converts wtmp files to the new format used by
utmpx(3). Now that HEAD has been branched to stable/9 and 9.0 is
released, there is no need for it in HEAD.

MFC after: never

Revert unintentional commit of changes to getnetgrent.c.

Add pidfile_fileno() to obtain the file descriptor for an open
pidfile.

Implement fdlopen(3), an rtld interface to load shared object by file
descriptor.

Requested and tested by: des (previous version)
Reviewed by: des, kan (previous version)
MFC after: 2 weeks

Replace index() and rindex() calls with strchr() and strrchr().

The index() and rindex() functions were marked LEGACY in the 2001
revision of POSIX and were subsequently removed from the 2008 revision.
The strchr() and strrchr() functions are part of the C standard.

This makes the source code a lot more consistent, as most of these C
files also call into other str*() routines. In fact, about a dozen
already perform strchr() calls.

Add some additional const poison after r228972. The 'mapping' array in
lib/libc/gen/strtofflags.c became const, but gcc did not warn about
assigning its members to non-const pointers. Clang warned about this
with:

lib/libc/gen/strtofflags.c:98:12: error: assigning to 'char *' from 'const char *' discards qualifiers [-Werror,-Wincompatible-pointer-types]
for (sp = mapping[i].invert ? mapping[i].name :
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Reviewed by: jilles

libc: Eliminate some relative relocations in file flags table.

libc: Eliminate some relative relocations in getusershell().

Fix a problem whereby a corrupt DNS record can cause named to crash. [11:06]

Add an API for alerting internal libc routines to the presence of
"unsafe" paths post-chroot, and use it in ftpd. [11:07]

Fix a buffer overflow in telnetd. [11:08]

Make pam_ssh ignore unpassphrased keys unless the "nullok" option is
specified. [11:09]

Add sanity checking of service names in pam_start. [11:10]

Approved by: so (cperciva)
Approved by: re (bz)
Security: FreeBSD-SA-11:06.bind
Security: FreeBSD-SA-11:07.chroot
Security: FreeBSD-SA-11:08.telnetd
Security: FreeBSD-SA-11:09.pam_ssh
Security: FreeBSD-SA-11:10.pam

- Fix style(9) bugs in glob.c

Approved by: jilles

- Add restrict keyword to glob(3)

PR: kern/161958
Submitted by: Henning Petersen <henning.petersen@t-online.de>
Approved by: jilles
MFC after: 3 days

Clean up includes; the prototype for getosreldate() has moved to
<unistd.h> in r183390.

Tweak the r137233 fix to r136283 -- Code was making two send() attempts
vs. the comment documented "If we are working with a privileged socket,
then take only one attempt". Make the code match.

Furthermore, critical privileged applications that [over] log a vast amount
can look like a DoS to this code. Given it's unlikely the single reattempted
send() will succeeded, avoid usurping the scheduler in a library API for a
single non-critical facility in critical applications.

Obtained from: Juniper Networks
Discussed with: glebius

style(9) fix.

Approved by: dim (mentor)

Return not-implemented from pthread_once and pthread_key_create, rather
than silently failing and returning success.

Without this, code calls pthread_once(), receives a return value of
success, and thinks that the passed function has been called.

Approved by: dim (mentor)

fdopendir(): Do not close the passed file descriptor on failure.

Reviewed by: delphij

Implement xlocale APIs from Darwin, mainly for use by libc++. This adds a
load of _l suffixed versions of various standard library functions that use
the global locale, making them take an explicit locale parameter. Also
adds support for per-thread locales. This work was funded by the FreeBSD
Foundation.

Please test any code you have that uses the C standard locale functions!

Reviewed by: das (gdtoa changes)
Approved by: dim (mentor)

Further reduce diffs with OpenBSD's arc4random. The main functional
change here is to ensure that when a process forks after arc4random
is seeded, the parent and child don't observe the same random sequence.
OpenBSD's fix introduces some additional overhead in the form of a
getpid() call. This could be improved upon, e.g., by setting a flag
in fork(), if it proves to be a problem.

This was discussed with secteam (simon, csjp, rwatson) in 2008, shortly
prior to my going out of town and forgetting all about it. The conclusion
was that the problem with forks is worrisome, but it doesn't appear to
have introduced an actual vulnerability for any known programs.

The only significant remaining difference between our arc4random and
OpenBSD's is in how we seed the generator in arc4_stir().

Sync the style, comments, and variable names of arc4random.c with
OpenBSD's version (r1.22). While some of our style changes were
indeed small improvements, being able to easily track functionality
changes in OpenBSD seems more useful.

Also fix style bugs in the FreeBSD-specific parts of this file.

No functional changes, as verified with md5.

Don't forget to kick the man page date.

Make our utmpx more like System V.

When booting the system, truncate the utx.active file, but do write the
BOOT_TIME record into it afterwards. This allows one to obtain the boot
time of the system as follows:

struct utmpx u1 = { .ut_type = BOOT_TIME }, *u2;

setutxent();
u2 = getutxid(&u1);

Now, the boot time is stored in u2->ut_tv, just like on Linux and other
systems.

We don't open the utx.active file with O_EXLOCK. It's rather unlikely
that other applications use this database at the same time and I want to
prevent the possibility of deadlocks in init(8).

Discussed with: pluknet

Fix the manual section number for a cross-reference to open(2) and sort it.

Reviewed by: ed
MFC after: 3 days

Replace a proliferation of buggy MD implementations of modf() with a
working MI one. The MI one only needs to be overridden on machines
with non-IEEE754 arithmetic. (The last supported one was the VAX.)
It can also be overridden if someone comes up with a faster one that
actually passes the regression tests -- but this is harder than it sounds.

- change "is is" to "is" or "it is"
- change "the the" to "the"

Approved by: lstewart
Approved by: sahil (mentor)
MFC after: 3 days

Reimplement ctermid().

Even though POSIX allows us to return simply /dev/tty as a pathname
identifying the controlling terminal of the running process, it is nicer
if this function were actually useful, by returning the actual pathname
of the controlling terminal.

Implement ctermid() by using the kern.devname sysctl to resolve the
actual name of /dev/tty. Don't use devname(3), since it may return bogus
strings like #C:0x123.

Get rid of major/minor number distinction.

As of FreeBSD 6, devices can only be opened through devfs. These device
nodes don't have major and minor numbers anymore. The st_rdev field in
struct stat is simply based a copy of st_ino.

Simply display device numbers as hexadecimal, using "%#jx". This is
allowed by POSIX, since it explicitly states things like the following
(example taken from ls(1)):

"If the file is a character special or block special file, the
size of the file may be replaced with implementation-defined
information associated with the device in question."

This makes the output of these commands more compact. For example, ls(1)
now uses approximately four columns less. While there, simplify the
column length calculation from ls(1) by calling snprintf() with a NULL
buffer.

Don't be afraid; if needed one can still obtain individual major/minor
numbers using stat(1).

posix_spawn: If an error is detected in the child process, reap the zombie.

Formerly, in this case an error was returned but the pid was also returned
to the application, requiring the application to use unspecified behaviour
(the returned pid in error situations) to avoid zombies.

Now, reap the zombie and do not return the pid.

MFC after: 2 weeks

Fix whitespace inconsistencies in libc in files copyrighted by me.

Sync with OpenBSD, primarily make the code easier to read, and a license
change to standard OpenBSD ISC license.

Obtained from: OpenBSD
MFC after: 2 weeks

Sync with OpenBSD (zap rcsid).

MFC after: 2 weeks

posix_spawn(3): Document r222511 (trying to close already closed fd).

MFC after: 1 week

Use size of int to fetch sysctl kern.sched.cpusetsize because it had
switched from long to int type in kernel.

Fixed by: pluknet

posix_spawn(): Do not fail when trying to close an fd that is not open.

As noted in Austin Group issue #370 (an interpretation has been issued),
failing posix_spawn() because an fd specified with
posix_spawn_file_actions_addclose() is not open is unnecessarily harsh, and
there are existing implementations that do not fail posix_spawn() for this
reason.

Reviewed by: ed
MFC after: 10 days

[mdoc] Fixed .Dt call.

Remove vestiges of disklabel(5).

Reviewed by: uqs
MFC after: 5 days

Allow strerror(0) and strerror_r(0, ...).

Of course, strerror_r() may still fail with ERANGE.

Although the POSIX specification said this could fail with EINVAL and
doing this likely indicates invalid use of errno, most other
implementations permitted it, various POSIX testsuites require it to
work (matching the older sys_errlist array) and apparently some
applications depend on it.

PR: standards/151316
MFC after: 1 week

Use FD_CLOEXEC explicitly.

MFC after: 3 days

Don't calculate len too early.

Follow style(9) in example code and handle opendir(3) error.

From fts.c comment:

The "FTS_NOSTAT" option can avoid a lot of calls to stat(2) if it knows that a
directory could not possibly have subdirectories. This is decided by looking at
the link count: a subdirectory would increment its parent's link count by
virtue of its own ".." entry. This assumption only holds for UFS-like
filesystems that implement links and directories this way, so we must punt for
others.

It looks like ZFS is a UFS-like file system, as the above also holds for ZFS.
Add ZFS to the list of file systems that allow for such optimization.

MFC after: 1 month

Add text string for ECAPMODE to libc.

Discussed with: anderson
Obtained from: Capsicum Project
Sponsored by: Google, Inc.
MFC after: 3 months

Fix style(9) issues in pututxline(3).

Also, make sure to initialize the `ret' variable properly.

Reported by: Cedric Jonas <cedric c84 eu>
Patch by: Garrett Cooper <yanegomi gmail com>

Add a utility, utxrm(8).

Most of the ports I broke when I imported utmpx, were simple management
utilities for the utmp database, allowing you to add/remove entries
manually.

Add a small tool called utxrm(8), which allows you to remove an entry
from the utmpx database by hand. This is useful when a login daemon
crashes or fails to remove the entry during shutdown.

Properly styleify utmpx code and document error codes in man page.

Submitted by: Garrett Cooper

Turn off default generation of userland dot symbols on powerpc64 now that
we have a binutils that supports it. Kernel dot symbols remain on to assist
DDB.

Don't forget to bump man page date for r218711.

Remove dead reference to regexp(3). Use regex(3) instead.

PR: docs/149950
Submitted by: arundel@

Document some more sysconf(3) variables.

MFC after: 1 month

rfork_thread(3): Mark deprecated in favor of pthread_create(3).

Make sys_signame upper case.

This matches the constants from <signal.h> with 'SIG' removed, which POSIX
requires kill and trap to accept and 'kill -l' to write.

'kill -l', 'trap', 'trap -l' output is now upper case.

In Turkish locales, signal names with an upper case 'I' are now accepted,
while signal names with a lower case 'i' are no longer accepted, and the
output of 'killall -l' now contains proper capital 'I' without dot instead
of a dotted capital 'I'.

Implement __pthread_map_stacks_exec() callback for libc, to change the
stack protection to allow execution for single-threaded processes.

Always set errno to a sane value when pututxline(3) fails.

For example, it will now return ESRCH when trying to replace a
nonexistent entry with DEAD_PROCESS.

Sync with OpenBSD, primarily better signal and terminal handling.

Obtained from: OpenBSD
MFC after: 2 weeks

Add a new libc function: cfmakesane(3).

I've noticed various terminal emulators that need to obtain a sane
default termios structure use very complex `hacks'. Even though POSIX
doesn't provide any functionality for this, extend our termios API with
cfmakesane(3), which is similar to the commonly supported cfmakeraw(3),
except that it fills the termios structure with sane defaults.

Change all code in our base system to use this function, instead of
depending on <sys/ttydefaults.h> to provide TTYDEF_*.

Add sysctl kern.sched.cpusetsize to export the size of kernel cpuset,
also add sysconf() key _SC_CPUSET_SIZE to get sysctl value.

Submitted by: gcooper

Fix error handling logic of pututxline(3).

Instead of only returning NULL when the entry is invalid and can't be
matched against the current database, also return it when it cannot open
the log files properly.

mdoc: drop redundant .Pp and .LP calls

They have no effect when coming in pairs, or before .Bl/.Bd

To support stack unwinding for cancellation points, add -fexceptions flag
for them, two functions _pthread_cancel_enter and _pthread_cancel_leave
are added to let thread enter and leave a cancellation point, it also
makes it possible that other functions can be cancellation points in
libraries without having to be rewritten in libthr.

Powerpc is special here. powerpc and powerpc64 use different ABIs, so
their implementations aren't in the same files. Introduce LIBC_ARCH
and use that in preference to MACHINE_CPUARCH. Tested by amd64 and
powerpc64 builds (thanks nathanw@)

MFtbemd:

Prefer MACHNE_CPUARCH to MACHINE_ARCH in most contexts where you want
to test of all the CPUs of a given family conform.

On shared object unload, in __cxa_finalize, call and clear all installed
atexit and __cxa_atexit handlers that are either installed by unloaded
dso, or points to the functions provided by the dso.

Use _rtld_addr_phdr to locate segment information from the address of
private variable belonging to the dso, supplied by crtstuff.c. Provide
utility function __elf_phdr_match_addr to do the match of address against
dso executable segment.

Call back into libthr from __cxa_finalize using weak
__pthread_cxa_finalize symbol to remove any atfork handler which
function points into unloaded object.

The rtld needs private __pthread_cxa_finalize symbol to not require
resolution of the weak undefined symbol at initialization time. This
cannot work, since rtld is relocated before sym_zero is set up.

Idea by: kan
Reviewed by: kan (previous version)
MFC after: 3 weeks

Introduce implementation-private rtld interface _rtld_addr_phdr, which
fills struct dl_phdr_info for the shared object that contains the
specified address, if any.

Idea and reviewed by: kan
MFC after: 3 weeks

Use aux vector to get values for SSP canary, pagesize, pagesizes array,
number of host CPUs and osreldate.

This eliminates the last sysctl(2) calls from the dynamically linked image
startup.

No objections from: kan
Tested by: marius (sparc64)
MFC after: 1 month

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Spelling fixes.

Also link getutxent.3 to utmpx.3.

If you run `man utmpx', you expect to get some info on it.

The 64-bit PowerPC ABI implemented in binutils 2.15 requires some special
quirks for weak-symbol handling. Text symbols require also marking weak
the special dot-symbol associated with the function, and data symbols
require that you not do that. To fix this, provide a hacked
__weak_reference for powerpc64, and define a new __weak_reference_data
for the single weak data symbol in base.

Revert after: binutils 2.17 import
Obtained from: projects/ppc64

mdoc: stop abusing -column lists and use .Bl -tag instead

mdoc: spell macros correctly, there's no need for the backslash escape

mdoc: consistently spell our email addresses <foo@FreeBSD.org>

Reviewed by: ru

mdoc: move CAVEATS, BUGS and SECURITY CONSIDERATIONS sections to the
bottom of the manpages and order them consistently.

GNU groff doesn't care about the ordering, and doesn't even mention
CAVEATS and SECURITY CONSIDERATIONS as common sections and where to put
them.

Found by: mdocml lint run
Reviewed by: ru

Fix a bug due to a type conversion from 64 to 32 bits. The side effect of
this type conversion is the high bits which were used to indicate if a
special character was a literal or special were dropped. As a result, all
special character were treated as special, even if they were supposed to
be literals.

Reviewed by: gad@
Approved by: mentor (wes@)

raise(3): Note that this sends a signal to the current thread, not process.

This is how it works (with threading libraries loaded) and what POSIX
requires.

MFC after: 1 week

Update xrefs from 4.3BSD to modern signal functions in various man pages.

sigvec(2) references have been updated to sigaction(2), sigsetmask(2) and
sigblock(2) to sigprocmask(2), sigpause(2) to sigsuspend(2).

Some legacy man pages still refer to them, that is OK.

sysctl(3): Update description of various kern.* variables.
Also add xrefs for confstr(3) (as sysconf(3) but for strings) and kvm(3)
(which is a more convenient way to access some of the variables).

PR: 116480
MFC after: 1 week

getcwd(3): Clarify that EACCES may or may not be checked.

POSIX permits but does not require checking access on the current and parent
directories.

Because various programs do not like it if getcwd(3) fails, it seems best
to avoid checking access as much as possible. There are various reports in
GNATS about this (search for getcwd).

Our getcwd(3) implementation first queries the kernel for the pathname
directly, which does not check any permissions but sometimes fails, and then
falls back to reading all parent directories for the names.

PR: standards/44425
MFC after: 2 weeks

fnmatch: Fix bad FNM_PERIOD disabling if an asterisk has been seen.

Example: fnmatch("a*b/*", "abbb/.x", FNM_PATHNAME | FNM_PERIOD)

PR: 116074
MFC after: 1 week

mdoc: order prologue macros consistently by Dd/Dt/Os

Although groff_mdoc(7) gives another impression, this is the ordering
most widely used and also required by mdocml/mandoc.

Reviewed by: ru
Approved by: philip, ed (mentors)

mdoc: don't abuse Bo/Pc to get what looks like an interval

Be explicit and use the general bracketing form plus symbols which are
to be interpreted mathematically in this case.

Complaint by: mdocml
Reviewed by: ru
Approved by: philip, ed (mentors)

mdoc: remove .Pp where not needed

This trips up mdocml and can simply go away.

Reviewed by: ru
Approved by: philip, ed (mentors)

Add prototype for libc internal interfaces.

Add prototypes for libc private interfaces.

While I'm there, apply __unused whenever appropriate.

Reviewed by: md5(1)

- Remove const'ness from dlerror(3) prototype, for consistency with POSIX.

Approved by: cognet
MFC after: 1 week

Let opendir() use O_DIRECTORY.

I am not removing the fstat() calls here, since we cannot yet assume
people will always run kernels that respect O_DIRECTORY.

Comment a fine point, so it does not get lost when people borrow code
from FreeBSD for other purposes.

The NetBSD Foundation has granted permission to remove clause 3 and 4 from
their software.

Obtained from: NetBSD

Split the contributed code from libc/stdtime from lib/libc/stdtime
to contrib/tzcode/stdtime.

Make pause(3) implementation not depended on the legacy sigcompat.c
interfaces. Do not block rt signals during and after pause(3) calls.
Use private libc namespace to call proper methods.

MFC after: 1 week

While there, trim some trailing whitespace.

Add proper const keywords to sysctl(3) parameters.

The `name' and `newp' arguments can be marked const, because the buffers
they refer to are never changed. While there, perform some other
cleanups:

- Remove K&R from sysctl.c.
- Implement sysctlbyname() using sysctlnametomib() to prevent
duplication of an undocumented kernel interface.
- Fix some whitespace nits.

It seems the prototypes are now in sync with NetBSD as well.

The static TLS size as given by tls_static_space includes TLS_TCB_SIZE
bytes of TCB in variant I.

Also add a cross-reference to NetBSD updlastlogx().

Bump .Dd, forgotten in r203393

Approved by: ed (mentor, implicit)
MFC after: 1 week

The multiplicand a = 0x5deece66d = 25214903917, not 0xfdeece66d.
This bug in the man page has gone unnoticed for over 15 years!

PR: docs/143461
Submitted by: Jeremy Huddleston jeremyhu apple.com
Approved by: ed (mentor, implicit)
MFC after: 1 week

Perform some cleanups to devname(3).

- Make sure the mode argument is either a character or a block device.
- Use S_IS*() instead of checking S_IF*-flags by hand.
- Don't use kern.devname when the argument is already NODEV.
- Always call snprintf with the proper amount of arguments corresponding
with the format.
- Perform some whitespace fixes. Tabs instead of 4 spaces, missing space
for return statement.
- Remove unneeded includes.

Remove pseudo-terminals from ttys(5).

When we had utmp(5), we had to list all the psuedo-terminals in ttys(5)
to make ttyslot(3) function properly. Now that pututxline(3) deals with
slot allocation internally (not based on TTY names), we don't need to
list all the TTYs on the system in ttys(5) to make user accounting work
properly.

This patch removes all the entries from the /etc/ttys files, but also
the pts(4) entries that were appended implicitly, which was added in
r154838.

Improve the ttyname(3) manual page.

- Remove unrelated references to tty(5).
- Remove unneeded relation with FILE *.
- Add better cross references.

EMPTY records don't have a timestamp.

Reapply r201145 to lib/libc/gen/sem.c

Just ignore the timestamps given to pututxline().

I've noticed many applications do a bad job at timekeeping, for several
reasons:

- Applications like screen(1) don't update time records when restoring
the old user login record.
- Many applications only set ut_tv.tv_sec, not ut_tv.tv_usec.

This causes many problems for tools such as ac(8), which require the
timestamps to be properly ordered. This is why I've decided to let the
utmpx code obtain valid timestamps itself.

English nitpicking.

Submitted by: jmallett

Describe why pututxline() doesn't entirely conform to standards.

Remove comments about breaking the specification.

I've discussed this issue with the Austin Group and it will be fixed in
future revisions of the specification. The issue was that ut_line fields
weren't supposed to be valid for LOGIN_PROCESS entries, while
getutxline() would try to match these records anyway.

They also agreed on our way of implementing pututxline() without
getutxid() (which other operating systems also do), but unfortunately
they disagreed with our way of replacing DEAD_PROCESS entries, which is
a pity. The current specification allows the utmpx database to become
infinitely big over time.

See also: http://austingroupbugs.net/view.php?id=213#c378

Style: reword comment.

Submitted by: bde

For alphasort() add reference to strcoll(3)

Style: rename internal function to opendir_compar()

Pointed by: bde

Style: remove extra empty line in the comment.

Pointed by: bde

Revert r202447 by re-exposing the old uname(3) function.

It makes hardly any sense to expose a symbol which should only be
provided for binary compatibility, but it seems we don't have a lot of
choice here. There are many autoconf scripts out there that try to
create a binary that links against the old symbol to see whether
uname(3) is present. These scripts fail to detect uname(3) now.

It should be noted that the behaviour we implement is not against the
standards:

| The following shall be declared as a function and may also be defined
| as a macro:
|
| int uname(struct utsname *);

Double checking my commit I found that comment saying that
POSIX 2008 and XSI 7require strcoll() for opendir() is not true.
I can't find such requirement in POSIX 2008 and XSI 7.

So, back out that part of my commit, returning old strcmp(), and remove
this misleading comment.

preserve errno when processing error cases.

a) Use strcoll() in opendir() and alphasort() as POSIX 2008 requires.
It also matches now how our 'ls' works for years.

b) Remove comment expressed 2 fears:
1) One just simple describe how strcoll() works in _any_ context,
not for directories only. Are we plan to remove strcoll() from everything
just because it is little more complex than strcmp()? I doubt, and
directories give nothing different here. Moreover, strcoll() used
in 'ls' for years and nobody complaints yet.

2) Plain wrong statement about undefined strcoll() behaviour. strcoll()
always gives predictable results, falling back to strcmp() on any
trouble, see strcoll(3).

No objections from -current list discussion.

Perform several small cleanups to the utmpx code.

- Massively reduce BSS usage. Let futx_to_utx() dynamically allocate the
structure. There is only a very small amount of applications out there
that needs to use the utmpx database. Wasting 1 KB on unused
structures makes little sense.

- Just let getutxid() search for matching ut_id's for any *PROCESS-type.
This makes the code a bit more future-proof.

- Fix a POSIX-mistake: when reading POSIX and the OpenSolaris
implementation, getutxline() must return USER_PROCESS and
LOGIN_PROCESS records whose ut_lines match. When reading POSIX, it
seems LOGIN_PROCESS should not use ut_line at the first place. I have
reported this issue.

Add forgotten break; keyword to getutxid().

We should not fall through to the ut_id comparison. Only ut_type should
be compared when using OLD_TIME, NEW_TIME, BOOT_TIME or SHUTDOWN_TIME.

Simplify ttyslot(3).

After comparing how other systems deal with utmp/utmpx, I noticed many
systems don't even care about ttyslot(3) anymore, since utmpx doesn't
use TTY slots anyway. We don't provide any tools to access old utmp
files anymore, so there is no use in letting applications write to a
proper offset within the utmp file.

Just let ttyslot(3) always return 0, which seems to be the default
behaviour on operating systems like Linux as well.

Unexpose the old uname(3) function.

Nowadays uname(3) is an inline function around __xuname(3). Prevent
linkage of new binaries against this compatibility function, similar to
what I did with ttyslot(3).

Also call sem_module_init in sem_close to initialize mutex
with some attributes.

Add wtmpcvt(1).

This utility allows users to convert their wtmp databases to the new
format. It makes no sense for users to keep their wtmp log files if they
are unable to view them.

It basically copies ut_line into ut_id as well. This makes it possible
for last(1) and ac(8) to match login records with their corresponding
logout record.

Remove ttyslot from Symbol.map anyway.

Requested by: kan

Unbreak pututxline() on 32-bit architectures.

I forgot to cast the size_t's back to off_t before negating them,
causing all sorts of artifacts where the log files would grow to 2^32 -
197 bytes.

Reported by: ume

Revert the change to Symbol.map, made in r202274.

Even though we use __sym_compat(), we should list the symbol in
Symbol.map.

ttyslot() is now listed as follows, which seems to do the right thing:

| Symbol table '.dynsym' contains 2755 entries:
| Num: Value Size Type Bind Vis Ndx Name
| 613: 00000000000477b0 121 FUNC GLOBAL DEFAULT 10 ttyslot@FBSD_1.0

Reported by: kib

Don't use fseeko() to obtain the file offset.

I was a bit confused with lseek(), which returns the new offset. We
should ftello() to obtain it using stdio.

Add two changes that should have gone into commit r202274.

Phase out ttyslot(3).

The ttyslot() function was originally part for SUSv1, marked LEGACY in
SUSv2 and removed later on. This function only makes sense when using
utmp(5), because it was used to determine the offset of the record for
the controlling TTY. It makes little sense to keep it here, because the
new utmpx file format doesn't index based on TTY slots.

Phase out ttyslot(3).

The ttyslot() function was originally part for SUSv1, marked LEGACY in
SUSv2 and removed later on. This function only makes sense when using
utmp(5), because it was used to determine the offset of the record for
the controlling TTY. It makes little sense to keep it here, because the
new utmpx file format doesn't index based on TTY slots.

Implement <utmpx.h>.

The utmpx interface is the standardized interface of the user accounting
database. The standard only defines a subset of the functions that were
present in System V-like systems.

I'd like to highlight some of the traits my implementation has:

- The standard allows the on-disk format to be different than the
in-memory representation (struct utmpx). Most operating systems don't
do this, but we do. This allows us to keep our ABI more stable, while
giving us the opportunity to modify the on-disk format. It also allows
us to use a common file format across different architectures (i.e.
byte ordering).

- Our implementation of pututxline() also updates wtmp and lastlog (now
called utx.log and utx.lastlogin). This means the databases are more
likely to be in sync.

- Care must be taken that our implementation discard any fields that are
not applicable. For example, our DEAD_PROCESS records do not hold a
TTY name. Just a time stamp, a record identifier and a process
identifier. It also guarantees that strings (ut_host, ut_line and
ut_user) are null terminated. ut_id is obviously not null terminated,
because it's not a string.

- The API and its behaviour should be conformant to POSIX, but there may
be things that slightly deviate from the standard. This implementation
uses separate file descriptors when writing to the log files. It also
doesn't use getutxid() to search for a field to overwrite. It uses an
allocation strategy similar to getutxid(), but prevents DEAD_PROCESS
records from accumulating.

Make sure libulog doesn't overwrite the manpages shipped with our C
library. Also keep the symbol list in Symbol.map sorted.

I'll bump __FreeBSD_version later this evening. I first want to convert
everything to <utmpx.h> and get rid of <utmp.h>.

Return SEM_FAILED instead of NULL, though there are same, but the
SEM_FAILED is more suitable name.
In function, sem_close(), always set errno on error.

Update manuals of sem_open and sem_init.

Submitted by: ru

Update manual for sem_init and sem_open, restrictions of shared semaphore
and 14 characters in name length no longer exist.

Reviewed by: deischen@

Remove BUGS section that no longer applies after recent changes to semaphore
code.

OK-ed by: davidxu

Don't forget to use fourth argument if O_CREAT is set in argument oflag.
The fourth specifies initial value for the semaphore.

Do not rely on behaviour undefined by ANSI C, use thunks to adapt
alphasort-like interface to the comparision function required by
qsort() and qsort_r().

For opendir() thunk and alphasort(), comment on why we deviated from
POSIX by using strcmp() instead of strcoll().

Requested and reviewed by: bde
MFC after: 2 weeks

More cleanup, remove _libc prefix because libthr no longer has stubs
referencing them.

forgot to remove SYM_FBP10. ;-)

Remove unused macros.

Don't check has_waiters twice, inline some small functions.
performance result on my machine:
mutex Elapsed: 902115 us; per iteration: 90 ns.
semaphore Elapsed: 958780 us; per iteration: 95 ns.

Use umtx to implement process sharable semaphore, to make this work,
now type sema_t is a structure which can be put in a shared memory area,
and multiple processes can operate it concurrently.
User can either use mmap(MAP_SHARED) + sem_init(pshared=1) or use sem_open()
to initialize a shared semaphore.
Named semaphore uses file system and is located in /tmp directory, and its
file name is prefixed with 'SEMD', so now it is chroot or jail friendly.
In simplist cases, both for named and un-named semaphore, userland code
does not have to enter kernel to reduce/increase semaphore's count.
The semaphore is designed to be crash-safe, it means even if an application
is crashed in the middle of operating semaphore, the semaphore state is
still safely recovered by later use, there is no waiter counter maintained
by userland code.
The main semaphore code is in libc and libthr only has some necessary stubs,
this makes it possible that a non-threaded application can use semaphore
without linking to thread library.
Old semaphore implementation is kept libc to maintain binary compatibility.
The kernel ksem API is no longer used in the new implemenation.

Discussed on: threads@

Modernize scandir(3) and alphasort(3) interfaces according to the IEEE
Std 1003.1-2008. Both Linux and Solaris conforms to the new definitions,
so we better follow too (older glibc used old BSDish alphasort prototype
and corresponding type of the comparision function for scandir). While
there, change the definitions of the functions to ANSI C and fix several
style issues nearby.

Remove requirement for "sys/types.h" include for functions from manpage.

POSIX also requires that alphasort(3) sorts as if strcoll(3) was used,
but leave the strcmp(3) call in the function for now.

Adapt in-tree callers of scandir(3) to new declaration. The fact that
select_sections() from catman(1) could modify supplied struct dirent is
a bug.

PR: standards/142255
MFC after: 2 weeks

Document CLOCK_SECOND, add cross-reference from time(3) to clock_gettime(2).

Based on submission by: pluknet gmail com
MFC after: 3 days

Use clock_gettime(CLOCK_SECOND) instead of gettimeofday(2) for
implementation of time(3). CLOCK_SECOND is much faster.

No objections from: phk
Submitted by: Valentin Nechayev <netch segfault kiev ua>
MFC after: 1 week

(S)LIST_HEAD_INITIALIZER takes a (S)LIST_HEAD as an argument.
Fix some wrong usages.
Note: this does not affect generated binaries as this argument is not used.

PR: 137213
Submitted by: Eygene Ryabinkin (initial version)
MFC after: 1 month

sem_init(3): document process shared semaphores and their restrictions

Fix many "function declaration isn't a prototype" warnings in libc.

I've only fixed code that seems to be written by `us'. There are still
many warnings like this present in resolv/, rpc/, stdtime/ and yp/.

Don't let the C library depend on <utmp.h>.

The maximum length of a username has nothing to do with the size of the
username in the utmp files. Use MAXLOGNAME, which is defined as 17
(UT_USERSIZE + 1).

Remove warnings from exec.c.

The entries in the argv array are not const themselves, but sometimes we
want to fill in const values. Just make the array const and use
__DECONST() to make it const for the execve()-call itself.

Also convert the only K&R prototype to ANSI.

Use ANSI C prototypes inside termios.

While there, add a missing __unused to hide a warning in tcsetbreak().

Remove (hidden) warning about missing prototypes for fdevname(3).

Properly use the envp argument in execvPe().

execvPe() is called by _execvpe(), which we added to implement
posix_spawnp(). We just took execvP() and added the envp argument.
Unfortunately we forgot to change the implementation to use envp over
environ.

This fixes the following piece of code:

| char * const arg[2] = { "env", NULL };
| char * const env[2] = { "FOO=BAR", NULL };
| posix_spawnp(NULL, "/usr/bin/env", NULL, NULL, arg, env);

MFC after: 2 weeks

Reset path name back to original correctly in fts_build() when
FTS_NOCHDIR option is used. fts_build() could strip a trailing slash
from path name in post-order visit if a path pointing to an empty
directory was given for fts_open().

PR: bin/133907, kern/134513
Reviewed by: das
Approved by: trasz (mentor)
MFC after: 1 month

Clarify that the value of the fts_info field is different in post-order.

Discussed with: das
Approved by: trasz (mentor)
MFC after: 1 week

Eliminate more dead stores.

Found by: Clang static analyzer
MFC after: 7 days

Revert the previous change to pthread_once() stub in libc. It is actually
a feature that libstdc++ depends on to simulate the behavior of libc's
internal '__isthreaded' variable. One benefit of this is that _libc_once()
is now private to _once_stub.c.

Requested by: kan

Add an internal _once() method. This works identical to pthread_once(3)
with the additional property that it is safe for routines in libc to use
in both single-threaded and multi-threaded processes. Multi-threaded
processes use the pthread_once() implementation from the threading library
while single-threaded processes use a simplified "stub" version internal
to libc. The libc stub-version of pthread_once() now also uses the
simplified "stub" version as well instead of being a nop.

Reviewed by: deischen, Matthew Fleming @ Isilon
Suggested by: alc
MFC after: 1 week

Catch up with r130332 which changed the default timezone from GMT to UTC.
Otherwise the tzload() (when called by gmtload()) fails to locate the UTC
file and loads the posixrules.

Fix a copy+paste error by checking the correct variable against MM_NULLACT.

PR: 140386
Submitted by: soulcatcher <soulcatcher13@gmail.com
MFC after: 1 week

Use our canonical .Dd format.

Submitted by: Ulrich Spoerlein

Move pselect(3) man page to section 2.

Noted by: jhb
MFC after: 1 month

Commit libc files missed in r198508

Current pselect(3) is implemented in usermode and thus vulnerable to
well-known race condition, which elimination was the reason for the
function appearance in first place. If sigmask supplied as argument to
pselect() enables a signal, the signal might be delivered before thread
called select(2), causing lost wakeup. Reimplement pselect() in kernel,
making change of sigmask and sleep atomic.

Since signal shall be delivered to the usermode, but sigmask restored,
set TDP_OLDMASK and save old mask in td_oldsigmask. The TDP_OLDMASK
should be cleared by ast() in case signal was not gelivered during
syscall execution.

Reviewed by: davidxu
Tested by: pho
MFC after: 1 month

wordexp(3): fix some bugs with signals and long outputs
* retry various system calls on EINTR
* retry the rest after a short read (common if there is more than about 1K
of output)
* block SIGCHLD like system(3) does (note that this does not and cannot
work fully in threaded programs, they will need to be careful with wait
functions)

PR: 90580
MFC after: 1 month

Make getcwd(3) faster, simpler and more compliant using *at syscalls.

It is no longer necessary to construct long paths consisting of repeated
"../" which may be slow to process and may exceed PATH_MAX.

Add a new errno, ENOTCAPABLE, to be returned when a process requests an
operation on a file descriptor that is not authorized by the descriptor's
capability flags.

MFC after: 1 month
Sponsored by: Google

Add basename_r(3) to complement basename(3). basename_r(3) which accepts
a caller-allocated buffer of at least MAXPATHLEN, rather than using a
global buffer.

MFC after: 1 month
Sponsored by: Google

fts_open() requires that the list passed as argument to contain at least
one path. When the list is empty (contain only a NULL pointer), return
EINVAL instead of pretending to succeed, which will cause a NULL pointer
deference in a later fts_read() call.

Noticed by: Christoph Mallon (via rdivacky@)
MFC after: 2 weeks

Correct the pthread stub prototype for pthread_mutexattr_settype to allow for
the type argument. This is known to fix some pthread_mutexattr_settype()
invocations, especially when it comes to pulseaudio.

Approved by: kib
deischen (threads)
MFC after: 3 days

Correct a section name; specifically, "AUTHOR" should be "AUTHORS". [1]

Turn the "AUTHORS" section into a full sentence.

Pointed out by: ru [1]

Add getpagesizes(3). This functions either the number of supported page
sizes or some number of the sizes themselves. It is functionally
compatible with a function by the same name under Solaris.

Reviewed by: jhb

It is believed the last subsystem that limited ID sizes to something
other than the current system-wide size (32-bits) has been updated so
for now just cautiously turn the check off. While here fix the check
for IDs being too large which doesn't work due to type mis-matches.

Reviewed by: jhb (previous version)
Approved by: re (kib)
MFC after: 1 month (type mis-match fixes only)

Implement RTLD_NOLOAD flag for dlopen(3).

Requested and tested by: jkim
Reviewed by: kan
Approved by: re (kensmith)

Move msg{snd,recv,get,ctl} manual pages from section 3 to 2.

Approved by: re (kib)

Make the structure definitions in the man pages match the real code, and
remove no longer valid caution.

Approved by: re (kensmith)

Change the ABI of some of the structures used by the SYSV IPC API:
- The uid/cuid members of struct ipc_perm are now uid_t instead of unsigned
short.
- The gid/cgid members of struct ipc_perm are now gid_t instead of unsigned
short.
- The mode member of struct ipc_perm is now mode_t instead of unsigned short
(this is merely a style bug).
- The rather dubious padding fields for ABI compat with SV/I386 have been
removed from struct msqid_ds and struct semid_ds.
- The shm_segsz member of struct shmid_ds is now a size_t instead of an
int. This removes the need for the shm_bsegsz member in struct
shmid_kernel and should allow for complete support of SYSV SHM regions
>= 2GB.
- The shm_nattch member of struct shmid_ds is now an int instead of a
short.
- The shm_internal member of struct shmid_ds is now gone. The internal
VM object pointer for SHM regions has been moved into struct
shmid_kernel.
- The existing __semctl(), msgctl(), and shmctl() system call entries are
now marked COMPAT7 and new versions of those system calls which support
the new ABI are now present.
- The new system calls are assigned to the FBSD-1.1 version in libc. The
FBSD-1.0 symbols in libc now refer to the old COMPAT7 system calls.
- A simplistic framework for tagging system calls with compatibility
symbol versions has been added to libc. Version tags are added to
system calls by adding an appropriate __sym_compat() entry to
src/lib/libc/incldue/compat.h. [1]

PR: kern/16195 kern/113218 bin/129855
Reviewed by: arch@, rwatson
Discussed with: kan, kib [1]

Use const instead of __const, and merge the license change from NetBSD.

Obtained from: NetBSD

In preparation for raising NGROUPS and NGROUPS_MAX, change base
system callers of getgroups(), getgrouplist(), and setgroups() to
allocate buffers dynamically. Specifically, allocate a buffer of size
sysconf(_SC_NGROUPS_MAX)+1 (+2 in a few cases to allow for overflow).

This (or similar gymnastics) is required for the code to actually follow
the POSIX.1-2008 specification where {NGROUPS_MAX} may differ at runtime
and where getgroups may return {NGROUPS_MAX}+1 results on systems like
FreeBSD which include the primary group.

In id(1), don't pointlessly add the primary group to the list of all
groups, it is always the first result from getgroups(). In principle
the old code was more portable, but this was only done in one of the two
places where getgroups() was called to the overall effect was pointless.

Document the actual POSIX requirements in the getgroups(2) and
setgroups(2) manpages. We do not yet support a dynamic NGROUPS, but we
may in the future.

MFC after: 2 weeks

Rename the queue macros I introduced last year.

Last year I added SLIST_REMOVE_NEXT and STAILQ_REMOVE_NEXT, to remove
entries behind an element in the list, using O(1) time. I recently
discovered NetBSD also has a similar macro, called SLIST_REMOVE_AFTER.
In my opinion this approach is a lot better:

- It doesn't have the unused first argument of the list pointer. I added
this, mainly because OpenBSD also had it.

- The _AFTER suffix makes a lot more sense, because it is related to
SLIST_INSERT_AFTER. _NEXT is only used to iterate through the list.

The reason why I want to rename this now, is to make sure we don't
release a major version with the badly named macros.

As the comment says, close() frees the variable, record. So we obtain
the length by evaluating the value from the copy, cbuf instead. This
fixes a crash caused by previous commit (use-after-free)

Submitted by: Dimitry Andric <dimitry andric com>
Pointy hat to: delphij

TTYs don't necessarily use /dev/ttyxx.

Submitted by: csjp

Add tcsetsid(3).

The entire world seems to use the non-standard TIOCSCTTY ioctl to make a
TTY a controlling terminal of a session. Even though tcsetsid(3) is also
non-standard, I think it's a lot better to use in our own source code,
mainly because it's similar to tcsetpgrp(), tcgetpgrp() and tcgetsid().

I stole the idea from QNX. They do it the other way around; their
TIOCSCTTY is just a wrapper around tcsetsid(). tcsetsid() then calls
into an IPC framework.

Fix whitespace and sorting in Symbol.map.

Allow the NULL, RTLD_SELF and RTLD_NEXT handles to work with dlfunc(3).
dlfunc() called dlsym() to do the work, and dlsym() determines the dso
that originating the call by the return address. Due to this, dlfunc()
operated as if the caller is always the libc.

To fix this, move the dlfunc() to rtld, where it can call the internal
implementation of dlsym, and still correctly fetch return address.
Provide usual weak stub for the symbol from libc for static binaries.
dlfunc is put to FBSD_1.0 symver namespace in the ld.so export to
override dlfunc@FBSD_1.0 weak symbol, exported by libc.

Reported, analyzed and tested by: Tijl Coosemans <tijl ulyssis org>
PR: standards/133339
Reviewed by: kan

Properly handle malloc() failures.

PR: bin/83338

Properly update the shm_open/shm_unlink symbol versioning metadata after
these functions were moved into the kernel:
- Move the version entries from gen/ to sys/. Since the ABI of the actual
routines did not change, I'm still exporting them as FBSD 1.0 on purpose.
- Add FBSD-private versions for the _ and __sys_ variants.

Document RTLD_NODELETE, -z nodelete and -z origin support.

Fix a file descriptor leak in fts_child().

Obtained from: NetBSD

Sync license changes.

Obtained from: NetBSD

Properly invalidate highest pts number when calling setttyent().

When calling setttyent() after calling endttyent(), pts_valid will never
be set to 1, because the readdir()-loop will likely never vind a pts
that has a higher number than before.

Simplify the code by removing pts_valid. We'll just set maxpts to -1
when we don't have a valid count yet.

Make ttyslot(3) work with pts(4) devices.

It seems ttyslot() calls rindex(), to strip the device name to the last
slash, but this is obviously invalid. /dev/pts/0 should be stripped
until pts/0. Because /etc/ttys only supports TTY names in /dev/, just
strip this piece of the pathname.

Add two new routines: fdevname() and fdevname_r().

A more elegant way of obtaining a name of a character device by its file
descriptor on FreeBSD, is to use the FIODGNAME ioctl. Because a valid
file descriptor implies a file descriptor is visible in /dev, it will
always resolve a valid device name.

I'm adding a more friendly wrapper for this ioctl, called fdevname(). It
is a lot easier to use than devname() and also has better error
handling. When a device name cannot be resolved, it will just return
NULL instead of a generated device name that makes no sense.

Discussed with: kib

Update the description of KERN_PROC.

PR: 100242
Reviewed by: jhb

The times(3) function returns the number of CLK_TCKs since the
startup time of FreeBSD, not since the UNIX Epoch.

PR: docs/122359
Submitted by: Viktor &#352;tujber
MFC after: 1 week

Add two rtld exported symbols, _rtld_atfork_pre and _rtld_atfork_post.
Threading library calls _pre before the fork, allowing the rtld to
lock itself to ensure that other threads of the process are out of
dynamic linker. _post releases the locks.

This allows the rtld to have consistent state in the child. Although
child may legitimately call only async-safe functions, the call may
need plt relocation resolution, and this requires working rtld.

Reported and debugging help by: rink
Reviewed by: kan, davidxu
MFC after: 1 month (anyway, not before 7.1 is out)

Update ZFS from version 6 to 13 and bring some FreeBSD-specific changes.

This bring huge amount of changes, I'll enumerate only user-visible changes:

- Delegated Administration

Allows regular users to perform ZFS operations, like file system
creation, snapshot creation, etc.

- L2ARC

Level 2 cache for ZFS - allows to use additional disks for cache.
Huge performance improvements mostly for random read of mostly
static content.

- slog

Allow to use additional disks for ZFS Intent Log to speed up
operations like fsync(2).

- vfs.zfs.super_owner

Allows regular users to perform privileged operations on files stored
on ZFS file systems owned by him. Very careful with this one.

- chflags(2)

Not all the flags are supported. This still needs work.

- ZFSBoot

Support to boot off of ZFS pool. Not finished, AFAIK.

Submitted by: dfr

- Snapshot properties

- New failure modes

Before if write requested failed, system paniced. Now one
can select from one of three failure modes:
- panic - panic on write error
- wait - wait for disk to reappear
- continue - serve read requests if possible, block write requests

- Refquota, refreservation properties

Just quota and reservation properties, but don't count space consumed
by children file systems, clones and snapshots.

- Sparse volumes

ZVOLs that don't reserve space in the pool.

- External attributes

Compatible with extattr(2).

- NFSv4-ACLs

Not sure about the status, might not be complete yet.

Submitted by: trasz

- Creation-time properties

- Regression tests for zpool(8) command.

Obtained from: OpenSolaris

Sync with OpenBSD's dirname(3) - license change, avoid strcpy() over
string constant, use memcpy() instead of strncpy() and improve code
readibility. No functional change.

In example use of err(3) and errx(3), use sysexits(3) constants.

MFC after: 3 days
Submitted by: Bruce Cran <bruce at cran dot org dot uk>

Fix a typo.

Approved by: kib (mentor)

Fix a typo. q is already a pointer.

Reported by: ache
Pointy hat to: kib

Remove doubtful structure definition with variable array members.
I believe this is not a valid C99 construct. Use directly calculated
offsets into the supplied buffer, using specified members length,
to fill appropriate structure.

Either use sysctl, or copy the value of the UNAME_x environment
variable, instead of unconditionally doing sysctl, and then
overriding a returned value with user-specified one.

Noted and tested by: rdivacky

Add unistd.h to the getosreldate(3) manpage.
Update referenced example to include unistd.h per manpage.
Update example to be more style(9)-ish, silence warnings and add
FreeBSD id to the source file.

<osreldate.h> does not have a forward declration of getosreldate(), so
remove it from this man page.

MFC after: 3 days

Return two fixes from previous backout which does not require
review by secteam@ for the reasons mentioned below.

1) Rename /dev/urandom to /dev/random since urandom marked as
XXX Deprecated
alias in /sys/dev/random/randomdev.c
(this is our naming convention and no review by secteam@ required)

2) Set rs_stired flag after forced initialization to prevent
double stearing.
(this is already in OpenBSD, i.e. they don't have double stearing.
It means that this change matches their code path and no additional
secteam@ review required)

Submitted by: Thorsten Glaser <tg@mirbsd.de> (2)

Set "max" to a reasonable value if BLOCKSIZE has a bogus unit. Prior
to this commit, "env BLOCKSIZE=4X df" prints not only "4X: unknown
blocksize" as expected, but sometimes also "maximum blocksize is 1G"
and "minimum blocksize is 512" depending on what happened to be on
the stack.

Found by: LLVM/Clang Static Checker

Restored from previous backing out (because that is OpenBSD way, so
assumed to be reviewd by them):
Stir directly from the kernel PRNG, without taking less random pid & time
bytes too (when it is possible).

The difference with OpenBSD code is that they have KERN_ARND sysctl for
that task, while we need to read /dev/random

Teach fmtcheck() about wint_t, intmax_t, char *, intmax_t *, and
wide string arguments.

Also simplify the code that handles length modifiers and make it
more conservative. For instance, be explicit about the modifiers
allowed for %d, rather than assuming that anything other than L,
q, t, or z implies an int argument.

Convert popen()'s `pidlist' to a SLIST, for consistency.

I guess the original author of the popen() code didn't want to use our
<sys/queue.h> macro's, because the single linked list macro's didn't
offer O(1) deletion. Because I introduced SLIST_REMOVE_NEXT() some time
ago, we can now use the macro's here.

By converting the code to an SLIST, it is more consistent with other
parts of the C library and the operating system.

Reviewed by: csjp
Approved by: philip (mentor, implicit)

Fix the email address formats in some posix_spawn(3) manpages.

It seems I made a small bug when writing some of the posix_spawn(3)
manpages. Remove the redundant "Ed Schouten", which broke the AUTHORS
section.

Approved by: philip (mentor, implicit)

Add manual pages for posix_spawn() functions.

PR: standards/122051

Per rwatson's request:
"If you don't get a review within a day or two, I would firmly recommend
backing out the changes"

back out all my changes, i.e. not comes from merging from OpenBSD as
unreviewed by secteam@ yet.
(OpenBSD changes stays in assumption they are reviewd by OpenBSD)

Yes, it means some old bugs returned, like not setted rs_stired = 1 in
arc4random_stir(3) causing double stirring.

Fixes based on bde's feedback.
1) Unindent and sort variables.
2) Indent struct members.
3) Remove _packed, use guaranteed >128 bytes size and only first 128
bytes from the structure.
4) Reword comment.

Obtained from: bde

Change /dev/urandom to /dev/random since urandom marked as
XXX Deprecated
alias in /sys/dev/random/randomdev.c

In arc4random_uniform() detect simple "power of two" case and
return just (arc4random() % upper_bound)

Add arc4random_uniform() function (to avoid "modulo bias")

Obtained from: OpenBSD

Increase initially dropped bytes from 512 to 768 (768 is also
suggested in the Ilya Mironov's article). 768 taken from another
research where it treats as default for RC4-drop(768):
http://www.users.zetnet.co.uk/hopwood/crypto/scan/cs.html#RC4-drop

Minor style tweak.

Add feature_present(3) to the FBSD 1.1 symbol map.

1) Use __packed attr on rdat structure to make it exact 128 bytes.
2) Use gettimeofday() and getpid() only if reading from /dev/urandom
fails or impossible.
3) Discard N bytes on very first initialization only (i.e. don't
discard on re-stir).
4) Reduce N from 1024 to 512 as really suggested in the
"(Not So) Random Shuffles of RC4" paper:
http://research.microsoft.com/users/mironov/papers/rc4full.pdf

1) Update copyright notice.
2) Eliminate "struct arc4_stream *as" arg since only single arg is
possible.
3) Set rs.j = rs.i after arc4random key schedule to be more like arc4
stream cipher.

Obtained from: OpenBSD

Add arc4random_buf to FBSD_1.1 space

Add arc4random_buf.3 to MLINKS

Implement arc4random_buf() function

Obtained from: OpenBSD

Decrease arc4_count only when needed and with proper bytes amount.

Obtained from: OpenBSD

1) Set stired flag after forced initialization.
2) Increase arc4_count to the limit OpenBSD use.

Submitted by: Thorsten Glaser <tg@mirbsd.de> (1)
Obtained from: OpenBSD (2)

Make it more clear what it means that SA_RESTART is set for signal
handlers added with signal(3).

Submitted by: gnn (slightly modified by me)
MFC after: 1 week

Gcc barfs in glob.c when run with -O3. To fix this make g_strchr() work on
and return (const Char *) pointers instead of just (Char *) and get rid of
all the type casting.

PR: kern/124334

Turn execvpe() into an internal libc routine.

Adding exevpe() has caused some ports to break. Even though execvpe() is
a useful routine, it does not conform to any standards.

This patch is a little bit different from the patch sent to the mailing
list. I forgot to remove execvpe from the Symbol.map (which does not
seem to miscompile libc, though).

Reviewed by: davidxu
Approved by: philip

Process spawn attributes in POSIX document order.

Style fix.

Change my email address to the one from the FreeBSD project.

Approved by: philip (mentor, implicit), davidxu

Add POSIX routines called posix_spawn() and posix_spawnp(), which
can be used as replacements for exec/fork in a lot of cases. This
change also added execvpe() which allows environment variable
PATH to be used for searching executable file, it is used for
implementing posix_spawnp().

PR: standards/122051

Do not read away the target directory entry when encountering deleted
files after a seekdir().

The seekdir shall set the position for the next readdir operation.
When the _readdir_unlocked() encounters deleted entry, dd_loc is
already advanced. Continuing the loop leads to premature read of
the target entry.

Submitted by: Marc Balmer <mbalmer at openbsd org>
Obtained from: OpenBSD
MFC after: 2 weeks

o Add MIPS to the list of architectures with defined TLS_TCB_ALIGN
o Stick with TLS Variant II for MIPS for the moment.

Approved by: imp

Implement fdopendir(3) by splitting __opendir2() into two parts, the upper part
deals with the usual __opendir2() calls, and the rest part with an interface
translator to expose fdopendir(3) functionality. Manual page was obtained from
kib@'s work for *at(2) system calls.

Style fixes to opendir.c:
- Use /*- for copyright block;
- ANSIfy.

Implement POSIX function tcgetsid() which returns session id.

PR: stand/107561

Minor style(9) nit: move to using ANSI definition of functions.

Fix descriptions of "struct msqid_ds and "struct ipc_perm" to match
harsh reality.

Document modff() and modfl(). Technically, modff() and modfl()
live in libm, while modf() lives in libc due to historical
mistakes. I'm claiming in the manpage that they all live in libm,
since programmers should not rely on the mistake.

Removed no longer existing CTL_MACHDEP defines.

Inspired by: phk

Add the new kernel-mode NFS Lock Manager. To use it instead of the
user-mode lock manager, build a kernel with the NFSLOCKD option and
add '-k' to 'rpc_lockd_flags' in rc.conf.

Highlights include:

* Thread-safe kernel RPC client - many threads can use the same RPC
client handle safely with replies being de-multiplexed at the socket
upcall (typically driven directly by the NIC interrupt) and handed
off to whichever thread matches the reply. For UDP sockets, many RPC
clients can share the same socket. This allows the use of a single
privileged UDP port number to talk to an arbitrary number of remote
hosts.

* Single-threaded kernel RPC server. Adding support for multi-threaded
server would be relatively straightforward and would follow
approximately the Solaris KPI. A single thread should be sufficient
for the NLM since it should rarely block in normal operation.

* Kernel mode NLM server supporting cancel requests and granted
callbacks. I've tested the NLM server reasonably extensively - it
passes both my own tests and the NFS Connectathon locking tests
running on Solaris, Mac OS X and Ubuntu Linux.

* Userland NLM client supported. While the NLM server doesn't have
support for the local NFS client's locking needs, it does have to
field async replies and granted callbacks from remote NLMs that the
local client has contacted. We relay these replies to the userland
rpc.lockd over a local domain RPC socket.

* Robust deadlock detection for the local lock manager. In particular
it will detect deadlocks caused by a lock request that covers more
than one blocking request. As required by the NLM protocol, all
deadlock detection happens synchronously - a user is guaranteed that
if a lock request isn't rejected immediately, the lock will
eventually be granted. The old system allowed for a 'deferred
deadlock' condition where a blocked lock request could wake up and
find that some other deadlock-causing lock owner had beaten them to
the lock.

* Since both local and remote locks are managed by the same kernel
locking code, local and remote processes can safely use file locks
for mutual exclusion. Local processes have no fairness advantage
compared to remote processes when contending to lock a region that
has just been unlocked - the local lock manager enforces a strict
first-come first-served model for both local and remote lockers.

Sponsored by: Isilon Systems
PR: 95247 107555 115524 116679
MFC after: 2 weeks

scandir(3) previously used st_size to obtain an initial estimate
of the array length needed to store all the directory entries.
Although BSD has historically guaranteed that st_size is the size
of the directory file, POSIX does not, and more to the point, some
recent filesystems such as ZFS use st_size to mean something else.

The fix is to not stat the directory at all, set the initial
array size to 32 entries, and realloc it in powers of 2 if that
proves insufficient.

PR: 113668

Remove trailing whitespace.

Add missing section number.

In file sem_timewait.3, remove reference to SYSV semphore in SEE ALSO
section, sync it with sem_wait.3.

Add missing comma.

Add manual for function sem_timedwait().

Reviewed by: ru, deischen

stdio is currently limited to file descriptors not greater than
{SHRT_MAX}, so {STREAM_MAX} should be no greater than that. (This
does not exactly meet the letter of POSIX but comes reasonably close
to it in spirit.)

MFC after: 14 days

Our fts(3) API, as inherited from 4.4BSD, suffers from integer
fields in FTS and FTSENT structs being too narrow. In addition,
the narrow types creep from there into fts.c. As a result, fts(3)
consumers, e.g., find(1) or rm(1), can't handle file trees an ordinary
user can create, which can have security implications.

To fix the historic implementation of fts(3), OpenBSD and NetBSD
have already changed <fts.h> in somewhat incompatible ways, so we
are free to do so, too. This change is a superset of changes from
the other BSDs with a few more improvements. It doesn't touch
fts(3) functionality; it just extends integer types used by it to
match modern reality and the C standard.

Here are its points:

o For C object sizes, use size_t unless it's 100% certain that
the object will be really small. (Note that fts(3) can construct
pathnames _much_ longer than PATH_MAX for its consumers.)

o Avoid the short types because on modern platforms using them
results in larger and slower code. Change shorts to ints as
follows:

- For variables than count simple, limited things like states,
use plain vanilla `int' as it's the type of choice in C.

- For a limited number of bit flags use `unsigned' because signed
bit-wise operations are implementation-defined, i.e., unportable,
in C.

o For things that should be at least 64 bits wide, use long long
and not int64_t, as the latter is an optional type. See
FTSENT.fts_number aka FTS.fts_bignum. Extending fts_number `to
satisfy future needs' is pointless because there is fts_pointer,
which can be used to link to arbitrary data from an FTSENT.
However, there already are fts(3) consumers that require fts_number,
or fts_bignum, have at least 64 bits in it, so we must allow for them.

o For the tree depth, use `long'. This is a trade-off between making
this field too wide and allowing for 64-bit inode numbers and/or
chain-mounted filesystems. On the one hand, `long' is almost
enough for 32-bit filesystems on a 32-bit platform (our ino_t is
uint32_t now). On the other hand, platforms with a 64-bit (or
wider) `long' will be ready for 64-bit inode numbers, as well as
for several 32-bit filesystems mounted one under another. Note
that fts_level has to be signed because -1 is a magic value for it,
FTS_ROOTPARENTLEVEL.

o For the `nlinks' local var in fts_build(), use `long'. The logic
in fts_build() requires that `nlinks' be signed, but our nlink_t
currently is uint16_t. Therefore let's make the signed var wide
enough to be able to represent 2^16-1 in pure C99, and even 2^32-1
on a 64-bit platform. Perhaps the logic should be changed just
to use nlink_t, but it can be done later w/o breaking fts(3) ABI
any more because `nlinks' is just a local var.

This commit also inludes supporting stuff for the fts change:

o Preserve the old versions of fts(3) functions through libc symbol
versioning because the old versions appeared in all our former releases.

o Bump __FreeBSD_version just in case. There is a small chance that
some ill-written 3-rd party apps may fail to build or work correctly
if compiled after this change.

o Update the fts(3) manpage accordingly. In particular, remove
references to fts_bignum, which was a FreeBSD-specific hack to work
around the too narrow types of FTSENT members. Now fts_number is
at least 64 bits wide (long long) and fts_bignum is an undocumented
alias for fts_number kept around for compatibility reasons. According
to Google Code Search, the only big consumers of fts_bignum are in
our own source tree, so they can be fixed easily to use fts_number.

o Mention the change in src/UPDATING.

PR: bin/104458
Approved by: re (quite a while ago)
Discussed with: deischen (the symbol versioning part)
Reviewed by: -arch (mostly silence); das (generally OK, but we didn't
agree on some types used; assuming that no objections on
-arch let me to stick to my opinion)

In getttyent(3), if /etc/ttys doesn't end in a newline, don't
freak out and keep trying to expand the buffer until realloc()
fails.

PR: 114398

Add a feature_present(3) function which checks to see if a named kernel
feature is present by checking the kern.features sysctl MIB.

MFC after: 1 week

Add a new file descriptor type for IPC shared memory objects and use it to
implement shm_open(2) and shm_unlink(2) in the kernel:
- Each shared memory file descriptor is associated with a swap-backed vm
object which provides the backing store. Each descriptor starts off with
a size of zero, but the size can be altered via ftruncate(2). The shared
memory file descriptors also support fstat(2). read(2), write(2),
ioctl(2), select(2), poll(2), and kevent(2) are not supported on shared
memory file descriptors.
- shm_open(2) and shm_unlink(2) are now implemented as system calls that
manage shared memory file descriptors. The virtual namespace that maps
pathnames to shared memory file descriptors is implemented as a hash
table where the hash key is generated via the 32-bit Fowler/Noll/Vo hash
of the pathname.
- As an extension, the constant 'SHM_ANON' may be specified in place of the
path argument to shm_open(2). In this case, an unnamed shared memory
file descriptor will be created similar to the IPC_PRIVATE key for
shmget(2). Note that the shared memory object can still be shared among
processes by sharing the file descriptor via fork(2) or sendmsg(2), but
it is unnamed. This effectively serves to implement the getmemfd() idea
bandied about the lists several times over the years.
- The backing store for shared memory file descriptors are garbage
collected when they are not referenced by any open file descriptors or
the shm_open(2) virtual namespace.

Submitted by: dillon, peter (previous versions)
Submitted by: rwatson (I based this on his version)
Reviewed by: alc (suggested converting getmemfd() to shm_open())

Fix a typo in regards to the ENOENT error.

PR: docs/118929
Submitted by: mymtom of hotmail
MFC after: 3 days

Implementing 'fallback' nsswitch source. 'fallback' source is used
when particular function can't be found in nsswitch-module. For
example, getgrouplist(3) will use module-supplied 'getgroupmembership'
function (which can work in an optimal way for such source as LDAP) and
will fall back to the stanard iterate-through-all-groups implementation
otherwise.

PR: ports/114655
Submitted by: Michael Hanselmann <freebsd AT hansmi DOT ch>
Reviewed by: brooks (mentor)

Since jb@ fixed the type of dd_lock in <dirent.h>, these casts are no
longer required.

Add _pthread_mutex_init_calloc_cb to libc's map, for which malloc defines
a stub.

Change the casts from (pthread_mutex_t *) to (void *) to keep gcc quiet.
Anybody with a cleaner solution feel free to change it.

Remove extraneous .Ef request.

MFC after: 3 days

VM_METER is long deprecated.

Rescue parts of the sensorsd commit that are still relevant:

- HW_FLOATINGPOINT renamed to HW_FLOATINGPT.
- Documented HW_REALMEM.
- Sorted as per <sys/sysctl.h>.

Backout sensors framework.

Requested by: phk
Discussed on: cvs-all

Fix mdoc in last commit.

Import OpenBSD's sysctl hardware sensors framework.

This commit includes the following core components:

* sample configuration file for sensorsd
* rc(8) script and glue code for sensorsd(8)
* sysctl(3) doc fixes for CTL_HW tree
* sysctl(3) documentation for hardware sensors
* sysctl(8) documentation for hardware sensors
* support for the sensor structure for sysctl(8)
* rc.conf(5) documentation for starting sensorsd(8)
* sensor_attach(9) et al documentation
* /sys/kern/kern_sensors.c
o sensor_attach(9) API for drivers to register ksensors
o sensor_task_register(9) API for the update task
o sysctl(3) glue code
o hw.sensors shadow tree for sysctl(8) internal magic
* <sys/sensors.h>
* HW_SENSORS definition for <sys/sysctl.h>
* sensors display for systat(1), including documentation
* sensorsd(8) and all applicable documentation

The userland part of the framework is entirely source-code
compatible with OpenBSD 4.1, 4.2 and -current as of today.

All sensor readings can be viewed with `sysctl hw.sensors`,
monitored in semi-realtime with `systat -sensors` and also
logged with `sensorsd`.

Submitted by: Constantine A. Murenin <cnst@FreeBSD.org>
Sponsored by: Google Summer of Code 2007 (GSoC2007/cnst-sensors)
Mentored by: syrinx
Tested by: many
OKed by: kensmith
Obtained from: OpenBSD (parts)

Add fts_set_clientptr(3), fts_get_clientptr(3) and fts_get_stream(3) man
page links to fts(3).

Approved by: wes
Approved by: re (hrs)
MFC after: 5 days

Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to
call the pad-less versions of the corresponding syscalls if the running
kernel supports it. Check kern.osreldate once per program and cache the
result to select the appropriate syscall. This maintains userland
compatability with kernel.old's from quite a while back.

Approved by: re (kensmith)

Some libc symbol map cleanups.

net: endhostdnsent is named _endhostdnsent and is
private to netdb family of functions.

posix1e: acl_size.c has been never compiled in,
so there's no "acl_size".

rpc: "getnetid" is a static function.

stdtime: "gtime" is #ifdef'ed out in the source.

some symbols are specific only to some architectures,
e.g., ___tls_get_addr is only defined on i386.

__htonl, __htons, __ntohl and __ntohs are no longer
functions, they are now (internal) defines in
<machine/endian.h>.

Submitted by: ru

ANSIfy function definitions, reduces diff against OpenBSD.

Use C comments since we now preprocess these files with CPP.

Cleanup sysconf(3) a bit. sysconf(3) assumes in some places it operates
on int, but in fact it should operate on long.
- Introduce 'lvalue' variable, which is long.
- Fix _SC_XOPEN_SHM for 64bit archs.
- Fix _SC_PHYS_PAGES for 64bit archs.
Reported by: simokawa
- Use lvalue for pathconf(3), as it returns long.
- Cast value explicitly to long on return.

Expand the description of the host's UUID.

OK'ed by: pjd

Clean-ip TLS symbol versions. [_]__tls_get_addr function is part of
the platform ABI and as such does not belong in FBSDprivate.

__libc_tls_* functions do not have to be visible to outside world
at all.

Document KERN_HOSTUUID.

Reminded by: ru

Bump date.

Add security.jail.mount_allowed sysctl, which allows to mount and
unmount jail-friendly file systems from within a jail.
Precisely it grants PRIV_VFS_MOUNT, PRIV_VFS_UNMOUNT and
PRIV_VFS_MOUNT_NONUSER privileges for a jailed super-user.
It is turned off by default.

A jail-friendly file system is a file system which driver registers
itself with VFCF_JAIL flag via VFS_SET(9) API.
The lsvfs(1) command can be used to see which file systems are
jail-friendly ones.

There currently no jail-friendly file systems, ZFS will be the first one.
In the future we may consider marking file systems like nullfs as
jail-friendly.

Reviewed by: rwatson

Add entry for dl_iterate_phdr.

Add stub for dl_iterate_phdr.

Change macro in order to refer to FreeBSD 7.0 instead of 7.0BSD.

Reported by: Michal Mertl <mime@traveller.cz>

Remove some stray roff formatting that caused incorrect rendering.

Don't assert() the TLS allocation requested is big enough; just
fix the argument.

In particular, this is a step towards breaking crt1's dependence on stdio.

o s/cgetseq/cgetset/

Obtained from: DragonFly

Remove getobjformat() from libc's symbol map. It probably should have been
in the private area anyway. Nothing in FreeBSD uses it any more anyway.

Retire more remnants of a.out support, as threatened in 2002.

Laughed-at-by: kris

o Remove duplicate includes.

Obtained from: Slava Semushin via NetBSD

Remove 3rd clause, renumber, ok per email

Per Regents of the University of Calfornia letter, remove advertising
clause.

# If I've done so improperly on a file, please let me know.

band-aide until _SC_PHYS_PAGES actually is defined

Add support for _SC_PHYS_PAGES, which is not standard, but can be found in
Solaris and Linux.

Document _SC_PAGESIZE. There are still 85 undocumented variables.

Obtained from: NetBSD

Minor clarification.

o As POSIX requires confstr(3) returns zero on errors, not -1.

PR: misc/106234
Submitted by: Guy Harris
MFC after: 1 week

More accurately document the implementation details of internal storage.

PR: docs/82508

Document what "msgsz" argument really denotes. [1]

Don't say that "msgsz" can be less than 0, it cannot
as it's unsigned (POSIX has the same bug).

PR: docs/101145 [1]
MFC after: 3 days

Fix TLS on sparc64 for statically and dynamically linked binaries
Approved by: rwatson (mentor)
Reviewed by: jmg and marcel

getenv.3: Put "is" on a line with other words
getobjformat.3: "takes precedence over" is not an envrionment variable.

PR: 75545
Submitted by: n-kogane@syd.odn.ne.jp
MFC after: 3 days

Automatically re-stir every 400000 calls

Obtained from: OpenBSD

Markup nit.

o Don't fseek() on closed file.

Submitted by: pgollucci@p6m7g8.com, Mark Costlow
MFC after: 3 weeks

Markup fixes.

Fix style(9) in code copied from rtld.

Fix the variant I allocation for KSE: Allow a larger TCB and assume
that the documented TCB is at the tail of the extended TCB. In other
words, the base of the TCB has a negative offset from the TLS.

o It speaks about struct msqid_ds not struct shmid_ds.

PR: docs/101314
Submitted by: Vasil Dimov
MFC after: 1 week

Return length from fwopen() file callback instead of zero.

The symptom is that syslog() fails to log anything but the "ident"
string if LOG_PERROR is specified to openlog(3) and the extensible
printf is in action.

For unclear, likely quaint historical reasons, syslog uses fwopen()
on a stack buffer, rather than using the more straightforward
and faster snprintf().

Along the way, fflush(3) is called, and since the callback writer
function returns zero instead of the length "written", __SERR
naturally gets set on the filedescriptor.

The extensible printf, in difference from the normal printf refuses
to output anything to an __SERR marked filedescriptor, and thus
the actual syslog message is supressed.

MFC: after 2 weeks

Remove stale comment about arm

o compat_group() and files_group() are more complicated than I thought
in rev. 1.34. Mainly I missed the fact that the buffer is used for two
purposes:

1) storing a group line from the group file;

2) __gr_parse_entry() parses the buffer and tries to put the group
members to the remaining part of the buffer and can fail if there
is no enough room for them.

Re-arrange the buffer size checks to account the latter case.

Submitted by: Kirk R Webb
MFC after: 2 weeks

- ANSIfy.
- Remove two unnecessary casts.

These changes would help gcc4 compile.

o Record a file offset for a last successfully parsed group file line.
If the initial buffer size (1KB) for the given group line is not big
enough, reset the offset. It helps to do not miss this line when
getrg() reallocates the larger buffer and tries to parse the line again.

PR: bin/52433, kern/55031, bin/83696, misc/97640, misc/98111
Submitted by: bsw71@mail.ru, Philip M. Gollucci, Justin Erenkrantz
Glanced at: nectar
MFC after: 1 month

Fix the output.

Noticed by: rodrigc

Reflect int -> size_t changes in glob.h

Reflect size_t changes in glob.h

Obtained from: NetBSD (mostly)

Remove the kludge, as asked in the Makefile:
# If you bump SHLIB_MAJOR, remove the kluge from gen/gethostname.c.

Reviewed by: ume

Save errno before calling pthread_mutex_lock because pthread_mutex_lock
may change errno unexpectly.

- Extend the nsswitch to support Services, Protocols and Rpc
databases.
- Make nsswitch support caching.

Submitted by: Michael Bushkov <bushman__at__rsu.ru>
Sponsored by: Google Summer of Code 2005

Correct usage example.

PR: docs/95059
Submitted by: Jos Backus
MFC after: 4 days

Document that VIS_CSTYLE encodes space (040) as '\s'.

PR: 95546
Submitted by: Jan Schaumann <jschauma@netmeister.org>
MFC after: 3 days

Allocate space for thread pointer, this allows thread library to access
its pointer from begin, and simplifies _get_curthread() in libthr.

Make _spinunlock() point to the spinunlock stub, not the
spinlock stub.

Add each directory's symbol map file to SYM_MAPS.

Add symbol maps and initial symbol version definitions to libc.

Reviewed by: davidxu

Add some more pthread stubs so that librt can use them.
The thread jump table has been resorted, so you need to
keep libc, libpthread, and libthr in sync.

Submitted by: xu

Remove debug printf.

Make getttyent() report what the pts ptys as well.

Use posix_memalign() in valloc() rather than making assumptions about
the alignment of malloc()ed memory.

Approved by: markm (mentor)

Implement ELF symbol versioning using GNU semantics. This code aims
to be compatible with symbol versioning support as implemented by
GNU libc and documented by http://people.redhat.com/~drepper/symbol-versioning
and LSB 3.0.

Implement dlvsym() function to allow lookups for a specific version of
a given symbol.

Make our ELF64 type definitions match standards. In particular this
means:
o Remove Elf64_Quarter,
o Redefine Elf64_Half to be 16-bit,
o Redefine Elf64_Word to be 32-bit,
o Add Elf64_Xword and Elf64_Sxword for 64-bit entities,
o Use Elf_Size in MI code to abstract the difference between
Elf32_Word and Elf64_Word.
o Add Elf_Ssize as the signed counterpart of Elf_Size.

MFC after: 2 weeks

Switch BUILD_ARCH in Makefile to use uname -p suggested by ru.
Switch strncpy to strlcpy suggested by gad and issue found by pjd.
Add to uname(3) man page describing:
UNAME_s
UNAME_r
UNAME_v
UNAME_m
Add to getosreldate(3) man page describing:
OSVERSION

Submitted by: ru, pjd/gad
Reviewed by: ru (man pages)

Unbreak build when I fluff the clean-up of __FBSDID diff reduction
before commit.

pointyhat++

Add support to easily build FreeBSD unpacked in a chroot of another
FreeBSD machine. To do this add the man 1 uname changes to __xuname.c
so we can override the settings it reports. Add OSVERSION override
to getosreldate. Finally which Makefile.inc1 to use uname -m instead
of sysctl -n hw.machine_arch to get the arch. type.

With these change you can put a complete FreeBSD OS image into a
chroot set:
UNAME_s=FreeBSD
UNAME_r=4.7-RELEASE
UNAME_v="FreeBSD $UNAME_r #1: Fri Jul 22 20:32:52 PDT 2005 fake@fake:/usr/obj/usr/src/sys/FAKE"
UNAME_m=i386
UNAME_p=i386
OSVERSION=470000
on an amd64 or i386 and it just work including building ports and using
pkg_add -r etc. The caveat for this example is that these patches
have to be applied to FreeBSD 4.7 and the uname(1) changes need to
be merged. This also addresses issue with libtool.

This is usefull for when a build machine has been trashed for an
old release and we want to do a build on a new machine that FreeBSD
4.7 won't run on ...

Add MLINK for execvP(3).

PR: docs/89783
Submitted by: Andreas Kohn andreas at syndrom23 dot de
MFC after: 3 days

Make SYNOPSIS compile after imp@'s changes.

Make SYNOPSIS compile.

Fix a stub function so that is has the correct number of
arguments. While I'm here, correct a couple of [tab] alignments.

Submitted by: bland

Make __sem_timedwait() consistent with the sem_timedwait() prototype.

Just by allocating size*2 bytes we can't be sure that new size will be enough,
so change two
if (size not enough) {
reallocf(size*2);
}
into
while (size not enough) {
reallocf(size*2);
}

Cosmetic fixes to prev. commit.
Change first MAXPATHLEN to more standard PATH_MAX
Change second MAXPATHLEN to 1024 (it is temp buffer not related)
Change comment to reflect that.

Suggested by: bde

Remove any hardcoded assumptions about malloc's way of allocating,
just use MAXPATHLEN. It prevents potential buffer overflow with other
malloc implementations.
(this change based on submitted patch)

PR: 86135
Submitted by: Trevor Blackwell <tlb@tlb.org>

Don't reuse *pl to skip [], it is already used for {} parts in the loop above
(submitted patch slightly modified)

PR: 86038
Submitted by: Gerd Rausch <gerd@juniper.net>

Include a couple of headers to ensure consistency between the prototype and
the function definition.

Add an MLINK for devname_r().

Include <sys/types.h> and <limits.h> ourselves, don't assume they are included
through <pthread.h>.

gen/sem.c: Prerequisite for <_semaphore.h>
net/getprotoent.c: USHRT_MAX
net/getservent.c: USHRT_MAX
stdio/ungetwc.c: MB_LEN_MAX
stdio/vfwscanf.c: MB_LEN_MAX

Add missing links from getgrent_r.3, getgrnam_r.3, and getgrgid_r.3 to
getgrent.3.

Submitted by: Ulf Lilleengen <lulf@kerneled.org>
MFC after: 3 days

Make syslog() use the internal (non-cancellation point) _usleep().
Prior to this it was calling the cancellable usleep() while holding
a lock.

Make usleep() overridable by the thread libraries so they can provide
cancellation points.

Noticed by: phk

Move initialization above point of first possible reference to
avoid overwriting ty_status values set from the 'type' field.

Previously TTY_DIALUP and TTY_NETWORK flags did not match
specified type.

fix innetgr() returning false positives and negatives when reverse netgroup
matching is used.

PR: 35506
MFC after: 3 days

Cross-reference sem_getvalue(3) from several other semaphore-related
functions.

MFC after: 3 days

Assorted markup fixes.

Approved by: re

When IPC_NOWAIT is set and there is no message, msgrcv() fails
with errno set to ENOMSG.

PR: docs/82217
Submitted by: delphij
Approved by: re (blanket)

reduce strlen() call.

use reentrant.h and simplify.

check return value of ttyname_r().

ttyname_r() didn't pass correct buffer size to devname_r().

Revert to old ttyname_r behavior that when _ioctl() returns 0 (SUCCEEDED),
return the buffer immediately. This will permit ssh and/or PAM logins
broken by previous commit.

The (potential) underlying problem is still under investigation.

Point hat to: me

Provide more POSIX-complaint ttyname_r(3) interface[1], which is slightly
different from what has been offered in libc_r (the one spotted in the
original PR which is found in libthr has already been removed by David's
commit, which is rev. 1.44 of lib/libthr/thread/thr_private.h):
- Use POSIX standard prototype for ttyname_r, which is,
int ttyname_r(int, char *, size_t);
Instead of:
char *ttyname_r(int, char *, size_t);
This is to conform IEEE Std 1003.1, 2004 Edition [1].
- Since we need to use standard errno for return code, include
errno.h in ttyname.c
- Update ttyname(3) implementation according to reflect the API
change.
- Document new ttyname_r(3) behavior
- Since we already make use of a thread local storage for
ttyname(3), remove the BUGS section.
- Remove conflicting ttyname_r related declarations found in libc_r.

Hopefully this change should not have changed the API/ABI, as the ttyname_r
symbol was never introduced before the last unistd.h change which happens a
couple of days before.

[1] http://www.opengroup.org/onlinepubs/009695399/functions/ttyname.html

Requested by: Tom McLaughlin <tmclaugh sdf lonestar org>
Through PR: threads/76938
Patched by: Craig Rodrigues <rodrigc crodrigues org> (with minor changes)
Prompted by: mezz@

Connect MLINKS for ttyname_r(3), and add prototype into unistd.h.

Cleanup for getgrouplist(3):
- Use /*- instead of /* for copyright section
- Include unistd.h for prototype of it
- Sort and separate includes as described in style(9)
- ANSIfy the function defination
- Use const for the traversing iterator

Include paths.h for prototype of getbootfile(3).

Add a sysctl that returns the full path of a process' text file.
This information is needed by things like `gdb -p' and Sun's javac,
and previously it could only be obtained via procfs

Remove unused variables and assignments.

Use prototypes in the function definitions.

Add some missing errnos from POSIX. Nothing in FreeBSD generates
these at the moment, but applications that test for them will now
have a better chance of compiling.

I have intentionally omitted errnos that are only good for STREAMS,
since apps that use STREAMS won't compile anyway. The exception is
EPROTO, which was apparently intended for STREAMS, but worth having
anyway because Linux (mis)uses it for other things.

Use __weak_reference macro to define weak symbols.

Teach fmtcheck() about the ' (thousands separator) flag.

Have ttyname_r() try to ask DEVFS for the device name.

Document ttyname_r().

Simplify threaded/unthreaded stuff a lot.

Make the returnvalue of times(3) insensitive to changes in wall-clock.

PR: 78537

Add manpage links for frexpf, frexpl, ldexpf, and ldexpl.

Document frexpl and ldexpl.

Fix incorrect comment.

Mark _rtld_allocate_tls and _rtld_free_tls as weak symbols for Variant I
tls.

Reviewed by: dfr

Add an EXAMPLES section[1], quote Nd, and bump doc date.

PR: 53621 [1]
Submitted by: Faried Nawaz <fn@hungry.com> [1]

Expand contractions.

Expand *n't contractions.

Fixed the misplaced $FreeBSD$.

Update my email address.

- Move the functions presently described in in ieee(3) to their own
manpages. They are not very related, so separating them makes it
easier to add meaningful cross-references and extend some of the
descriptions.
- Move the part of math(3) that discusses IEEE 754 to the ieee(3)
manpage.

- Document ldexpf().
- Although ldexp() is in libc for backwards compatibility, ldexpf() is
in its proper place in libm. Document both as being in libm.
- The ldexp() and ldexpf() functions conform to C99.

- Document frexpf().
- Neither frexp() nor frexpf() set errno.
- Although frexp() is in libc for backwards compatibility, frexpf() is
in its proper place in libm. Document both as being in libm.
- The frexp() and frexpf() functions conform to C99.

Replace the ldexp() implementation in libc with a renamed copy of the
scalbn() implementation from libm. (The two functions are defined to
be identical, but ldexp() lives in libc for backwards compatibility.)
The old ldexp() implementation...
- was more complicated than this one
- set errno instead of raising FP exceptions
- got some corner cases wrong
(e.g. ldexp(1.0, 2000) in round-to-zero mode)

The new implementation lives in libc/gen instead of
libc/$MACHINE_ARCH/gen, since we don't need N copies of a
machine-independent file. The amd64 and i386 platforms
retain their fast and correct MD implementations and
override this one.

Sort sections.

Markup: convert a display to a list.

remember to reset nextgrp in getnetgrent(), so that subsequent calls to getnetgrent() doesn't return bogus information.

MFC after: 3 days

The `timep' argument of utime() is not an array of structs.
Make sure we don't confuse the reader by claiming it is.

PR: docs/75615
Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Update manual page after adding 'fts_bignum' field.

Submitted by: Peter Jeremy <PeterJeremy@optushome.com.au>
MFC after: 5 days

Introduce new field 'fts_bignum' which is 64bit long and will allow to
make utilities like du(1) 64bit-clean.
When this field is used, one cannot use 'fts_number' and 'fts_pointer'
fields.

This commit doesn't break API nor ABI.

This work is part of the BigDisk project:

http://www.FreeBSD.org/projects/bigdisk/

Discussed on: arch@
MFC after: 5 days

Make syslog(3) thread safe.

PR: bin/72394
Submitted by: Dan Nelson
Reviewed by: deischen
MFC after: 2 weeks

Add LOG_NTP facility.

Submitted by: Kurt Jaeger <pi at complx dot LF dot net>
Approved by: ru
MFC after: 3 days

Mark up SIGSTOP with .Dv and use .Nm in HISTORY for marking up `signal'.

PR: docs/75615
Submitted by: n-kogane@syd.odn.ne.jp

Restore standard behavior: log to console only when normal logging
failed, not always.

PR: bin/75356
Submitted by: Mark Knight <markk knigma org>
Pointy hat to: glebius
MFC after: 3 days

Better rendering of the prototype for signal(3).

Suggested by: ru

o The macro versions of sigemptyset(3), sigfillset(3), sigaddset(3),
sigdelset(3) and sigismember(3) were killed about five years ago.

o The functions (specifically sigismember(3)) could return -1 and
set errno.

PR: bin/75156
Obtained from: NetBSD
MFC after: 2 weeks

o Bump the date of the document.

Fix description: the argument to setcontext(3) must have been previously
initialized "by a call to getcontext(3) or makecontext(3)" and not "by a
call to setcontext(3) or makecontext(3)".

MFC after: 3 days

Remove ntp_gettime.c which was a wrapper around sysctlbyname(3).
This is now a native system call.

Reviewed by: imp, phk, njl, peter
Approved by: njl

Add knob NO_NIS (fka NO_YP_LIBC) and make world compileable when set.
If turned on no NIS support and related programs will be built.

Lost parts rediscovered by: Danny Braniss <danny at cs.huji.ac.il>
PR: bin/68303
No objections: des, gshapiro, nectar
Reviewed by: ru
Approved by: rwatson (mentor)
MFC after: 2 weeks

Protect against local flooder of /var/run/log. Do not loop forever in
syslog(3) if we are a priveleged program (sshd, su, etc.).

- Make syslogd open an additional socket /var/run/logpriv, with 0600
permissions.
- In libc, try to use this socket.
- Do not loop forever if we are using this socket (partial backout of 1.31)

Reviewed by: dwmalone, Andrea Campi <andrea webcom it>
Approved by: julian (mentor)
MFC after: 1 month

When send()ing to syslogd return ENOBUFS keep trying until success.

This fixes a case, when DoSed syslogd completely loses messages.

PR: bin/72366
Discussed with: dwmalone, millert@OpenBSD.org
Approved by: julian (mentor)
Obtained from: OpenBSD (rev. 1.17, 1.21 by millert)
MFC after: 3 months

Mutually cross-reference sysexits(3) and err(3). Add text to err(3)
recommending that the standard exit codes in sysexits(3) be used.

Reviewed by: ru