- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

system(): Restore behaviour for SIGINT and SIGQUIT.

As mentioned in r16117 and the book "Advanced Programming in the Unix
Environment" by W. Richard Stevens, we should ignore SIGINT and SIGQUIT
before forking, since it is not guaranteed that the parent process starts
running soon enough.

To avoid calling sigaction() in the vforked child, instead block SIGINT and
SIGQUIT before vfork() and keep the sigaction() to ignore after vfork(). The
FreeBSD kernel discards ignored signals, even if they are blocked;
therefore, it is not necessary to unblock SIGINT and SIGQUIT earlier.

Make example more correct (errstr is a pointer, not boolean).

vfork(2) was listed as deprecated in 1994 (r1573) and was the false
reports of its impending demise were removed in 2009 (r199257).

However, in 1996 (r16117) system(3) was switched from vfork(2) to
fork(2) based partly on this. Switch back to vfork(2). This has a
dramatic effect in cases of extreme mmap use - such as excessive
abuse (500+) of shared libraries.

popen(3) has used vfork(2) for a while. vfork(2) isn't going anywhere.

[fix to r253380] __setenv: be explicit about placing '=' after name

This should a regression introduced in r253380 if malloc'ed memory
happens to have '=' at the right place.

Reported by: ache
Pointyhat to: me (avg)
MFC after: 1 day
X-MFC with: r253380

libc: name passed into __setenv is not necessarily NUL-terminated

That's particularly true when __setenv is called from __merge_environ.

MFC after: 4 days

Style fix noted by bde@

After fixing ranges restore POSIX requirement: rand() call without
srand() must be the same as srand(1); rand();
(yet one increment)

In addition to prev. commit, for repeated rand_r(3) calls don't forget
to compensate back at the end incremented at the start internal
state.

MFC after: 2 weeks

1) POSIX requires rand(3) return values to be in the [0, RAND_MAX] range,
but ACM formula we use have internal state (and return value) in the
[1, 0x7ffffffe] range, so our RAND_MAX (0x7fffffff) is never reached
because it is off by one, zero is not reached too.

Correct both RAND_MAX and rand(3) return value, shifting last one
to the 0 by 1 subtracted, resulting POSIXed [0, 0x7ffffffd(=new RAND_MAX)]
range.

2) Add a checks for not overflowing on too big seeds. It may happens on
the machines, where sizeof(unsigned int) > 32 bits.

Reviewed by: bde [1]
MFC after: 2 weeks

Renumber clauses to reduce diffs to other versions

NetBSD, OpenBSD, and Android's Bionic number the clauses 1 through 3,
so follow suit to make comparison easier.

Renumber clauses to reduce diffs to other versions

NetBSD, OpenBSD, and Android's Bionic number the clauses 1 through 3,
so follow suit to make comparison easier.

Make the malloc(3) family of functions weak and make their non-weak
implementations visible for use by applications. The functions $F that
are now weak symbols are:
allocm, calloc, dallocm, free, malloc, malloc_usable_size,
nallocm, posix_memalign, rallocm, realloc, sallocm

The non-weak implementations of $F are exported as __$F.

Submitted by: stevek@juniper.net
Reviewed by: jasone@, kib@
Approved by: jasone@ (jemalloc)
Obtained from: juniper Networks, Inc

Fix a typo: It should be "strtoll" and not "stroll".

PR: 178642
Reported by: Michael Galassi (michaelgalassi@gmail.com)
Approved by: sbruno (mentor)
MFC after: 1 week

Add example.

PR: 177025
Submitted by: Fernando <fernando.apesteguia@gmail.com>
Reviewed by: theraven

- Correct mispellings of the word occurrence

Submitted by: Christoph Mallon <christoph.mallon@gmx.de> (via private mail)

Replace access to /dev/random with the kernel pseudo-random number
source sysctl(KERN_ARND) and remove the fallback code.

Obtained from: OpenBSD
Reviewed by: secteam
MFC after: 1 month

Add restrict keyword to realpath manpage.

Now that qsort(3) has a sample comparison function, point to that
example from bsearch(3) too, so that we don't have to duplicate
the example code in both places.

PR: docs/176197
Reviewed by: stefanf
Approved by: remko (mentor), gjb (mentor)
MFC after: 1 week

Sort sections.

Various improvements to the qsort(3) usage example:

- Remove unused #include.
- Do not cast away const.
- Use the canonical idiom to compare two numbers.
- Use proper type for sizes, i.e. size_t instead of int.
- Correct indentation.
- Simplify printf("\n") to puts("").
- Use return instead of exit() in main().

Submitted by: Christoph Mallon, christoph.mallon at gmx.de
Approved by: gjb (mentor)
Reviewed by: stefanf
MFC after: 1 week

Add a sample program that shows how a custom comparison function and
qsort(3) can work together to sort an array of integers.

PR: docs/176197
Submitted by: Fernando, fapesteguia at opensistemas.com
Approved by: gjb (mentor)
MFC after: 1 week

Remove undefined behavior from sranddev() and
srandomdev(). This doesn't actually work
with any modern C compiler:

In particular, both clang and modern gcc
verisons silently elide any xor operation
with 'junk'.

Approved by: secteam
MFC after: 3 days

Optimize prev. commit for speed.
1) Don't iterate the loop from the environment array beginning each time,
iterate it under the last place we deactivate instead.
2) Call __rebuild_environ() not on each iteration but once, only at the end
of whole loop (of course, only in case if something is changed).

MFC after: 1 week

Using putenv() and later direct pointer contents modification it is possibe
to craft environment variables with similar names like that:
a=1
a=2
...
unsetenv("a") should remove them all to make later getenv("a") impossible.
Fix it to do so (this is GNU autoconf test #3 failure too).

PR: 172273
MFC after: 1 week

libc: Use O_CLOEXEC for various internal file descriptors.

This fixes a race condition where another thread may fork() before CLOEXEC
is set, unintentionally passing the descriptor to the child process.

This commit only adds O_CLOEXEC flags to open() or openat() calls where no
fcntl(fd, F_SETFD, FD_CLOEXEC) follows. The separate fcntl() call still
leaves a race window so it should be fixed later.

Slight stylification.

According to a clarification at http://austingroupbugs.net/view.php?id=503
ptsname may set errno, so avoid saving and restoring errno across the
function.

PR: standards/171572

Avoid mapping ENOENT to ENOTDIR for non-existent path components.

The ENOTDIR mapping was introduced in r235266 for kern/128933 based on
an interpretation of the somewhat ambiguous language in the POSIX realpath
specification. The interpretation is inconsistent with Solaris and Linux,
a regression from 9.0, and does not appear to be permitted by the
description of ENOTDIR:

20 ENOTDIR Not a directory. A component of the specified pathname
existed, but it was not a directory, when a directory was
expected.

PR: standards/171577
MFC after: 3 days

Add the same warning to rand48(3) as to rand(3) and random(3).

MFC after: 3 days

Bump dates.

Reminded by: bz@

Add a prominent warning about these functions' unsuitability for
cryptographic purposes, and recommend using arc4random(3) instead.

Make 'junk' volatile so that compilers won't be tempted to optimize

Reviewed by: ache
MFC after: 3 days

Update the 'C1x draft' reference to '.St -isoC-2011' mdoc macro.

Reviewed by: theraven
MFC after: 1 week

Remove end of line whitespace.

Add more locale-specific functions to the relevant man pages and
Makefiles:
- libc/stdtime/strftime.3
- libc/stdtime/strptime.3
- libc/stdlib/strfmon.3

Reviewed by: theraven
Approved by: gabor (mentor)

Switch from 4-clause to 2-clause BSD license. (OpenBSD r1.22)
No functional change.

Obtained from: NetBSD via OpenBSD

1) Although unpublished version of standard
http://austingroupbugs.net/view.php?id=385#c713
(Resolved state) recommend this way for the current standard (called
"earlier" in the text)

"However, earlier versions of this standard did not require this, and the
same example had to be written as:

// buf was obtained by malloc(buflen)
ret = write(fd, buf, buflen);
if (ret < 0) {
int save = errno;
free(buf);
errno = save;
return ret;
}
"

from feedback I have for previous commit it seems that many people prefer
to avoid mass code change needed for current standard compliance
and prefer to track unpublished standard instead, which requires now
that free() itself must save errno, not its usage code.

So, I back out "save errno across free()" part of previous commit,
and will fill PR for changing free() isntead.

2) Remove now unused serrno.

MFC after: 1 week

1) IEEE Std 1003.1-2008, "errno" section, is explicit that

"The setting of errno after a successful call to a function is
unspecified unless the description of that function specifies that
errno shall not be modified."

However, free() in IEEE Std 1003.1-2008 does not mention its interaction
with errno, so MAY modify it after successful call
(it depends on particular free() implementation, OS-specific, etc.).

So, save errno across free() calls to make code portable and
POSIX-conformant.

2) Remove unused serrno assignment.

MFC after: 1 week

General mdoc(7) and typo fixes.

PR: 167734
Submitted by: Nobuyuki Koganemaru (kogane!jp.freebsd.org)
MFC after: 3 days

According to SUSv4, realpath(3) must fail if
[ENOENT] A component of file_name does not name an existing file or
file_name points to an empty string.
[ENOTDIR] A component of the path prefix is not a directory, or the
file_name argument contains at least one non- <slash> character
and ends with one or more trailing <slash> characters and the last
pathname component names an existing file that is neither a
directory nor a symbolic link to a directory.
Add checks for the listed conditions, and set errno accordingly.

Update the realpath(3) manpage to mention SUS behaviour. Remove the
requirement to include sys/param.h before stdlib.h.

PR: 128933
MFC after: 3 weeks

Import jemalloc 9ef7f5dc34ff02f50d401e41c8d9a4a928e7c2aa (dev branch,
prior to 3.0.0 release) as contrib/jemalloc, and integrate it into libc.
The code being imported by this commit diverged from
lib/libc/stdlib/malloc.c in March 2010, which means that a portion of
the jemalloc 1.0.0 ChangeLog entries are relevant, as are the entries
for all subsequent releases.

Remove trailing whitespace per mdoc lint warning

Disussed with: gavin
No objection from: doc
Approved by: joel
MFC after: 3 days

Add aligned_alloc(3).

The C11 folks reinvented the wheel by introducing an aligned version of
malloc(3) called aligned_alloc(3), instead of posix_memalign(3). Instead
of returning the allocation by reference, it returns the address, just
like malloc(3).

Reviewed by: jasone@

Properly sort functions by name.

Add missing opening and closing brackets in getopt_long.3 and getsubopt.3
to make the examples reflect reality more closely.

MFC after: 1 week
X-MFC-After: 9.0-RELEASE

Since clang does not support the tls_model attribute used in malloc.c
yet (see LLVM PR 9788), and warns about it, rub it out for now. When
clang grows support for this attribute, I will revert this again.

MFC after: 1 week

Small style(9) improvements.

Approved by: dim (mentor)

Some fixes to the man pages for [at_]quick_exit(3)

Reviewed by: pluknet
Approved by: dim (mentor)

style(9) cleanups.

Approved by: brooks (mentor)

Implement quick_exit() / at_quick_exit() from C++11 / C1x. Also add a
__noreturn macro and modify the other exiting functions to use it.

The __noreturn macro, unlike __dead2, must be used BEFORE the function.
This is in line with the C and C++ specifications that place _Noreturn (c1x)
and [[noreturn]] (C++11) in front of the functions. As with __dead2, this
macro falls back to using the GCC attribute.

Unfortunately, clang currently sets the same value for the C version macro
in C99 and C1x modes, so these functions are hidden by default. At some
point before 10.0, I need to go through the headers and clean up the C1x /
C++11 visibility.

Reviewed by: brooks (mentor)

Implement xlocale APIs from Darwin, mainly for use by libc++. This adds a
load of _l suffixed versions of various standard library functions that use
the global locale, making them take an explicit locale parameter. Also
adds support for per-thread locales. This work was funded by the FreeBSD
Foundation.

Please test any code you have that uses the C standard locale functions!

Reviewed by: das (gdtoa changes)
Approved by: dim (mentor)

Fix a warning emitted by Clang.

The size passed to strlcat() must depend on the input length, not the
output length. Because the input and output buffers are equal in size,
the resulting binary does not change at all.

Fix building of 32-bit compat libraries on amd64 with clang, and using
-g, by reverting r219139. The LLVM PR referenced in that revision was
fixed in the mean time, and we imported a clang snapshot soon
afterwards, so the temporary workaround of disabling clang's integrated
assembler is no longer needed.

In this particular case, using e.g. DEBUG_FLAGS=-g causes clang to
output certain directives into assembly that our version of GNU as
chokes on.

Reported by: dougb
Approved by: re (kib)

Fix whitespace inconsistencies in libc in files copyrighted by me.

Change sparc64 to use the initial exec TLS model, too. This avoids random
assertion failures in _malloc_thread_cleanup().

Don't add sigwait.c to MISRCS here when sigwait.c lives under ../sys and
it's already added to SRCS there.

Now that TLS generally is available on sparc64 since r219534 turn on
support for it. Note that while sparc64 also supports the static TLS
model and thus tls_model("initial-exec"), using the default model
turned out to yield slightly better buildstone performance.

Correct a typo in the malloc(3) manpage. Malloc options are set in the
MALLOC_OPTIONS environment variable, not JEMALLOC_OPTIONS.

Reviewed by: jasone
Approved by: emaste (mentor)

Put in a temporary workaround for ctfmerge hanging on processing
kernel.debug (or possibly other files), when WITH_CTF is active.

This is caused by a bug in clang's integrated assembler, causing malloc
to sometimes hang during initialization in statically linked executables
that use threading, such as the copy of ctfmerge that is built during
the bootstrap stage of buildworld. The bug has been submitted upstream:

http://llvm.org/bugs/show_bug.cgi?id=9352

Note that you might have to rebuild and install libc first, to get your
kernel build to finish, because the ctfmerge binary built during
bootstrap is linked with your base system's copy of libc.a, which might
already contain a bad copy of malloc.o.

Fix some style(9) issues.
Do not use strlcpy() where simple assignment is enough.

Noted by: bde (long time ago)
MFC after: 1 week

Revert to r214147, errno is not clobbered as originally
thought.

Document strtonum()s behavior of setting errno to 0 when no error is found.

PR: docs/143330
Submitted by: Efstratios Karatzas (gpf dot kira at gmail dot com)
Discussed with: ru@
MFC after: 7 days

Sync with OpenBSD rev. 1.13:
strtonum does not require limits.h

Obtained from: OpenBSD
Discussed with: ru@
MFC after: 5 days

mdoc: drop redundant .Pp and .LP calls

They have no effect when coming in pairs, or before .Bl/.Bd

Missed space.

Submitted by: brueffer
MFC after: 1 week

Add cross-references to lrand48(3) and arc4random(3) from rand(3)
and random(3).

Submitted by: Valentin Nechayev <netch netch kiev ua>
MFC after: 1 week

Revert changes of 'assure' to 'ensure' made in r211936.

Approved by: rrs (mentor)

Because POSIX does not allow EINTR to be returned from sigwait(),
add a wrapper for it in libc and rework the code in libthr, the
system call still can return EINTR, we keep this feature.

Discussed on: thread
Reviewed by: jilles

Fix incorrect usage of 'assure' and 'insure'.

Approved by: rrs (mentor)

Do not call __pthread_cxa_finalize with invalid struct dl_phdr_info.

Reported and tested by: Fabian Keil <freebsd-listen fabiankeil de>
MFC after: 17 days

Powerpc is special here. powerpc and powerpc64 use different ABIs, so
their implementations aren't in the same files. Introduce LIBC_ARCH
and use that in preference to MACHINE_CPUARCH. Tested by amd64 and
powerpc64 builds (thanks nathanw@)

MFtbemd:

Prefer MACHNE_CPUARCH to MACHINE_ARCH in most contexts where you want
to test of all the CPUs of a given family conform.

On shared object unload, in __cxa_finalize, call and clear all installed
atexit and __cxa_atexit handlers that are either installed by unloaded
dso, or points to the functions provided by the dso.

Use _rtld_addr_phdr to locate segment information from the address of
private variable belonging to the dso, supplied by crtstuff.c. Provide
utility function __elf_phdr_match_addr to do the match of address against
dso executable segment.

Call back into libthr from __cxa_finalize using weak
__pthread_cxa_finalize symbol to remove any atfork handler which
function points into unloaded object.

The rtld needs private __pthread_cxa_finalize symbol to not require
resolution of the weak undefined symbol at initialization time. This
cannot work, since rtld is relocated before sym_zero is set up.

Idea by: kan
Reviewed by: kan (previous version)
MFC after: 3 weeks

Style.

MFC after: 3 days

Use aux vector to get values for SSP canary, pagesize, pagesizes array,
number of host CPUs and osreldate.

This eliminates the last sysctl(2) calls from the dynamically linked image
startup.

No objections from: kan
Tested by: marius (sparc64)
MFC after: 1 month

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Fix typos and spelling mistakes.

Comment out IEEE Std 1003.1-2001 conformance proclaimed too early,
see problems described in the comment to:
http://www.freebsd.org/cgi/query-pr.cgi?pr=kern/128933

mdoc: remove unbalanced quotes

Provide 64-bit PowerPC support in libc.

Obtained from: projects/ppc64

In threaded processes, destroy the mutex atexit_mutex when we've
finished using it. This allows the mutex's allocated memory to be
freed.

This is one sense a rather silly change, since at this point we're
less than a microsecond away from calling _exit; but fixing this
memory leak is likely to make life easier for anyone trying to
track down other memory leaks.

mdoc: move CAVEATS, BUGS and SECURITY CONSIDERATIONS sections to the
bottom of the manpages and order them consistently.

GNU groff doesn't care about the ordering, and doesn't even mention
CAVEATS and SECURITY CONSIDERATIONS as common sections and where to put
them.

Found by: mdocml lint run
Reviewed by: ru

The previous revision actually removed the bug being hinted at, so
go ahead and remove the hint.

PR: 143944
Submitted by: Jeremy Huddleston <jeremyhu@apple.com>
MFC after: 1 week

C language does not has references, it provides pointers.

Suggested by: bde
MFC after: 2 weeks

Add standards section, improve wording, taking into account the handling
of NULL and changed type in declaration.

Suggested by: bde
MFC after: 2 weeks

Free() is not allowed to modify errno, remove safety brackets around it [1].
Add small optimization, do not copy a string to the buffer that is
to be freed immediately after.

Noted by: jh [1]
Reviewed by: jh
MFC after: 2 weeks

Slightly modernize realpath(3).

SUSv4 requires that implementation returns EINVAL if supplied path is NULL,
and ENOENT if path is empty string [1].
Bring prototype in conformance with SUSv4, adding restrict keywords.
Allow the resolved path buffer pointer be NULL, in which case realpath(3)
allocates storage with malloc().

PR: kern/121897 [1]
MFC after: 2 weeks

mdoc: order prologue macros consistently by Dd/Dt/Os

Although groff_mdoc(7) gives another impression, this is the ordering
most widely used and also required by mdocml/mandoc.

Reviewed by: ru
Approved by: philip, ed (mentors)

In reallocf(3), free the memory only when size != 0. Otherwise, when the
System V compatibility option (malloc "V" flag) is in effect a zero sized
reallocf() could cause a double free.

PR: bin/141753
Submitted by: Dan Lukes

Rewrite red-black trees to do lazy balance fixup. This improves
insert/remove speed by ~30%.

Define TLS_MODEL for PowerPC as well. Since PowerPC uses variant I,
like ia64, leave it empty (default model).

Unbreak ia64: tls_model("initial-exec") is invalid, because it assumes
the static TLS model, which is fundamentally different from the dynamic
TLS model. The consequence was data corruption. Limit the attribute to
i386 and amd64.

Fix PR
http://www.freebsd.org/cgi/query-pr.cgi?pr=bin/143350
Empty string test gone wrong.

Testing this requires that you have a locale that has the sign string
unset but has int_n_sign_posn set (the default locale falls through to
use "()" around negative numbers which is probably another bug).

I created that setup by hand and indeed without this fix negative
numbers are put out as positive numbers (doesn't fall through to use
"-" as default indicator).

Unfixed example in nl_NL.ISO8859-1 with lc->negative_sign set to empty
string:
strfmon(buf, sizeof(buf), "%-8i", -42.0);
==>
example2: 'EUR 42,00' 'Eu 42,00'

Fixed:
example2: 'EUR 42,00-' 'Eu 42,00-'

This file and suggested fix are identical in at least freebsd-8.
Backport might be appropriate but some expert on locales should
probably have a look at us defaulting to negative numbers in
parenthesis when LC_* is default. That doesn't look right and is not
what other OSes are doing.

PR: 143350
Submitted by: Corinna Vinschen
Reviewed by: bug reporter submitted, tested by me

Fix bugs:

* Fix a race in chunk_dealloc_dss().

* Check for allocation failure before zeroing memory in base_calloc().

Merge enhancements from a divergent version of jemalloc:

* Convert thread-specific caching from magazines to an algorithm that is
more tunable, and implement incremental GC.

* Add support for medium size classes, [4KiB..32KiB], 2KiB apart by
default.

* Add dirty page tracking for pages within active small/medium object
runs. This allows malloc to track precisely which pages are in active
use, which makes dirty page purging more effective.

* Base maximum dirty page count on proportion of active memory.

* Use optional zeroing in arena_chunk_alloc() to avoid needless zeroing
of chunks. This is useful in the context of DSS allocation, since a
long-lived application may commonly recycle chunks.

* Increase the default chunk size from 1MiB to 4MiB.

Remove feature:

* Remove the dynamic rebalancing code, since thread caching reduces its
utility.

Add missing return, in a rare case where we can't allocate memory in
deallocate.

Submitted by: Ryan Stone (rysto32 at gmail dot com)
Approved by: jasone

Simplify arena_run_reg_dalloc(), and remove a bug that was due to incorrect
initialization of ssize_invs.

Fix the posix_memalign() changes in r196861 to actually return a NULL pointer
as intended.

PR: standards/138307

Revert behavior change to setenv(), unsetenv() and putenv() until a more
thorough security review has been completed.

Update the getenv(3) man page to reflect the recent change to the behavior
of setenv(), putenv() and unsetenv() when dealing with corrupt entries in
environ. They now output a warning and complete their task without error.

MFC after: 1 week

Change the behavior of setenv(), putenv() and unsetenv() to continue parsing
instead of returning an error if a corrupt (not a "name=value" string) entry
in the environ array is detected when (re)-building the internal
environment. This should prevent applications or libraries from
experiencing issues arising from the expectation that these calls will
complete even with corrupt entries. The behavior is now as it was prior to
7.0.

Reviewed by: jilles
MFC after: 1 week

Improve the comment within getenv() explaining the search order it takes to
find a variable. Include a note that it must not cause the internal
environment to be generated since malloc() depends upon getenv(). To call
malloc() would create a circular dependency.

Recommended by: green
Approved by: jilles
MFC after: 1 week

Fix many "function declaration isn't a prototype" warnings in libc.

I've only fixed code that seems to be written by `us'. There are still
many warnings like this present in resolv/, rpc/, stdtime/ and yp/.

Temporarily revert the previous change because the linker has been
modified so that it will abort when the environment is bad.

Do not gratuitously fail *env(3) operations due to corrupt ('='-less)
**environ entries. This puts non-getenv(3) operations in line with
getenv(3) in that bad environ entries do not cause all operations to
fail. There is still some inconsistency in that getenv(3) in the
absence of any environment-modifying operation does not emit corrupt
environ entry warnings.

I also fixed another inconsistency in getenv(3) where updating the
global environ pointer would not be reflected in the return values.
It would have taken an intermediary setenv(3)/putenv(3)/unsetenv(3)
in order to see the change.

Change the utrace log entry for malloc_init from (0, 0, 0) to (-1, 0, 0)
in order to distinguish it from free(NULL), which is logged as (0, 0, 0).

Reviewed by: jhb

Make malloc(3) superpage aware. Specifically, if getpagesizes(3) returns
a large page size that is greater than malloc(3)'s default chunk size but
less than or equal to 4 MB, then increase the chunk size to match the large
page size.

Most often, using a chunk size that is less than the large page size is not
a problem. However, consider a long-running application that allocates and
frees significant amounts of memory. In particular, it frees enough memory
at times that some of that memory is munmap()ed. Up until the first
munmap(), a 1MB chunk size is just fine; it's not a problem for the virtual
memory system. Two adjacent 1MB chunks that are aligned on a 2MB boundary
will be promoted automatically to a superpage even though they were
allocated at different times. The trouble begins with the munmap(),
releasing a 1MB chunk will trigger the demotion of the containing superpage,
leaving behind a half-used 2MB reservation. Now comes the real problem.
Unfortunately, when the application needs to allocate more memory, and it
recycles the previously munmap()ed address range, the implementation of
mmap() won't be able to reuse the reservation. Basically, the coalescing
rules in the virtual memory system don't allow this new range to combine
with its neighbor. The effect being that superpage promotion will not
reoccur for this range of addresses until both 1MB chunks are freed at some
point in the future.

Reviewed by: jasone
MFC after: 3 weeks

Handle zero size for posix_memalign. Return NULL or unique address
according to the 'V' option.

PR: standards/138307
MFC after: 1 week

Our implementation of granpt(3) could be valid in the future.

When I wrote the pseudo-terminal driver for the MPSAFE TTY code, Robert
Watson and I agreed the best way to implement this, would be to let
posix_openpt() create a pseudo-terminal with proper permissions in place
and let grantpt() and unlockpt() be no-ops.

This isn't valid behaviour when looking at the spec. Because I thought
it was an elegant solution, I filed a bug report at the Austin Group
about this. In their last teleconference, they agreed on this subject.
This means that future revisions of POSIX may allow grantpt() and
unlockpt() to be no-ops if an open() on /dev/ptmx (if the implementation
has such a device) and posix_openpt() already do the right thing.

I'd rather put this in the manpage, because simply mentioning we don't
comply to any standard makes it look worse than it is. Right now we
don't, but at least we took care of it.

Approved by: re (kib)
MFC after: 3 days

Simplify. We can just use .sinclude here.

Submitted by: Christoph Mallon

Our grantpt(3) and unlockpt(3) don't comply with POSIX.

"-isoC-99" should be spelled without 'c'.

Add two new routines: fdevname() and fdevname_r().

A more elegant way of obtaining a name of a character device by its file
descriptor on FreeBSD, is to use the FIODGNAME ioctl. Because a valid
file descriptor implies a file descriptor is visible in /dev, it will
always resolve a valid device name.

I'm adding a more friendly wrapper for this ioctl, called fdevname(). It
is a lot easier to use than devname() and also has better error
handling. When a device name cannot be resolved, it will just return
NULL instead of a generated device name that makes no sense.

Discussed with: kib

Fix language on atol(3) manpage. Add a COMPATIBILITY section
stating that in FreeBSD the atol() and atoll() functions affect
errno in the same way as strtol() and stroll().

PR: docs/126487
Submitted by: edwin
Reviewed by: trhodes, gabor
MFC after: 1 week

Fix a lock order reversal bug that could cause deadlock during fork(2).

Reported by: kib

Adjust an assertion to handle the case where a lock is contested, but
spinning is avoided due to running on a single-CPU system.

Reported by: stefanf

Do not spin when trying to lock on a single-CPU system.

Reported by: davidxu

Revert to preferring mmap(2) over sbrk(2) when mapping memory, due to
potential extreme contention in the kernel for multi-threaded applications
on SMP systems.

Reported by: kris

MTC r183949:
Allow to define MALLOC_PRODUCTION with a make variable instead of polluting
the global CFLAGS.

Reviewed by: jasone

Clean out some empty mergeinfo records, presumably by people doing local
cp/mv operations. The full repo-relative URL should be specified for the
source in these cases.

Use PAGE_{SIZE,MASK,SHIFT} from machine/param.h rather than hard-coding
page size and using sysconf(3).

Suggested by: marcel

Unbreak ia64: pges are 8KB.

Add thread-specific caching for small size classes, based on magazines.
This caching allows for completely lock-free allocation/deallocation in the
steady state, at the expense of likely increased memory use and
fragmentation.

Reduce the default number of arenas to 2*ncpus, since thread-specific
caching typically reduces arena contention.

Modify size class spacing to include ranges of 2^n-spaced, quantum-spaced,
cacheline-spaced, and subpage-spaced size classes. The advantages are:
fewer size classes, reduced false cacheline sharing, and reduced internal
fragmentation for allocations that are slightly over 512, 1024, etc.

Increase RUN_MAX_SMALL, in order to limit fragmentation for the
subpage-spaced size classes.

Add a size-->bin lookup table for small sizes to simplify translating sizes
to size classes. Include a hard-coded constant table that is used unless
custom size class spacing is specified at run time.

Add the ability to disable tiny size classes at compile time via
MALLOC_TINY.

Remove grantpt.c, which should have been deleted in the MPSAFE TTY commit.

The routines in grantpt.c have been moved to ptsname.c in the MPSAFE TTY
layer, because grantpt() is now effectively a no-op. I forgot to remove
the corresponding source file from libc.

Integrate the new MPSAFE TTY layer to the FreeBSD operating system.

The last half year I've been working on a replacement TTY layer for the
FreeBSD kernel. The new TTY layer was designed to improve the following:

- Improved driver model:

The old TTY layer has a driver model that is not abstract enough to
make it friendly to use. A good example is the output path, where the
device drivers directly access the output buffers. This means that an
in-kernel PPP implementation must always convert network buffers into
TTY buffers.

If a PPP implementation would be built on top of the new TTY layer
(still needs a hooks layer, though), it would allow the PPP
implementation to directly hand the data to the TTY driver.

- Improved hotplugging:

With the old TTY layer, it isn't entirely safe to destroy TTY's from
the system. This implementation has a two-step destructing design,
where the driver first abandons the TTY. After all threads have left
the TTY, the TTY layer calls a routine in the driver, which can be
used to free resources (unit numbers, etc).

The pts(4) driver also implements this feature, which means
posix_openpt() will now return PTY's that are created on the fly.

- Improved performance:

One of the major improvements is the per-TTY mutex, which is expected
to improve scalability when compared to the old Giant locking.
Another change is the unbuffered copying to userspace, which is both
used on TTY device nodes and PTY masters.

Upgrading should be quite straightforward. Unlike previous versions,
existing kernel configuration files do not need to be changed, except
when they reference device drivers that are listed in UPDATING.

Obtained from: //depot/projects/mpsafetty/...
Approved by: philip (ex-mentor)
Discussed: on the lists, at BSDCan, at the DevSummit
Sponsored by: Snow B.V., the Netherlands
dcons(4) fixed by: kan

Move CPU_SPINWAIT into the innermost spin loop, in order to allow faster
preemption while busy-waiting.

Submitted by: Mike Schuster <schuster@adobe.com>

Re-order the terms of an expression in arena_run_reg_dalloc() to correctly
detect whether the integer division table is large enough to handle the
divisor. Before this change, the last two table elements were never used,
thus causing the slow path to be used for those divisors.

Remove variables which are assigned values and never used thereafter.

Found by: LLVM/Clang Static Checker
Approved by: jasone

Restructure and use different variables in the tests that involve
environ[0] to be more obvious that environ is not NULL before environ[0]
is tested. Although I believe the previous code worked, this change
improves code maintainability.

Reviewed by: ache
MFC after: 3 days

Detect if the application has cleared the environ variable by setting
the first value (environ[0]) to NULL. This is in addition to the
current detection of environ being replaced, which includes being set to
NULL. Without this fix, the environment is not truly wiped, but appears
to be by getenv() until an *env() call is made to alter the enviroment.

This change is necessary to support those applications that use this
method for clearing environ such as Dovecot and Postfix. Applications
such as Sendmail and the base system's env replace environ (already
detected). While neither of these methods are defined by SUSv3, it is
best to support them due to historic reasons and in lieu of a clean,
defined method.

Add extra units tests for clearing environ using four different methods:
1. Set environ to NULL pointer.
2. Set environ[0] to NULL pointer.
3. Set environ to calloc()'d NULL-terminated array.
4. Set environ to static NULL-terminated array.

Noticed by: Timo Sirainen

MFC after: 3 days

Enhance arena_chunk_map_t to directly support run coalescing, and use
the chunk map instead of red-black trees where possible. Remove the
red-black trees and node objects that are obsoleted by this change. The
net result is a ~1-2% memory savings, and a substantial allocation speed
improvement.

- This code was intially obtained from NetBSD, but it's missing licence
statement. Add the one from the current NetBSD version.
- Also bump a date to reflect my content changes I have done in previous
revision

Approved by: imp
MFC after: 3 days

- Add description about a missing return value

PR: docs/75995
Submitted by: Tarc <tarc@po.cs.msu.su>
MFC after: 3 days

- remove superfluous word
- remove contractions

MFC after: 3 days

Mark the section describing return values with an appropriate section flag.

PR: docs/122818
MFC after: 3 days

Don't export the unused __use_pts() routine.

The __use_pts() routine was once probably used by libutil to determine
if we are using BSD or UNIX98 style PTY device names. It doesn't seem to
be used outside grantpt.c, which means we can make it static and remove
it from the Symbol.map.

Reviewed by: cognet, kib
Approved by: philip (mentor)

In the error path through base_alloc(), release base_mtx [1].

Fix bit vector initialization for run headers.

Submitted by: [1] Mike Schuster <schuster@adobe.com>

Clean up cpp logic and comments.

Fix a comment.

Add a separate tree to track arena chunks that contain dirty pages.
This substantially improves worst case allocation performance, since
O(lg n) tree search can be used instead of O(n) tree iteration.

Use rb_wrap() instead of directly calling rb_*() macros.

Add rb_wrap(), which creates C function wrappers for most rb_*()
macros.

Add rb_foreach_next() and rb_foreach_reverse_prev(), which make it
possible to re-synchronize tree iteration after the tree has been
modified.

Rename rb_tree_new() to rb_new().

Set QUANTUM_2POW_MIN and SIZEOF_PTR_2POW parameters for MIPS

Approved by: imp

Check for integer overflow before calling sbrk(2), since it uses a
signed increment argument, but the size is an unsigned integer.

Stricter check for integer overflow.

Implement red-black trees without using parent pointers, and store the
color bit in the least significant bit of the right child pointer, in
order to reduce red-black tree linkage overhead by ~2X as compared to
sys/tree.h.

Use the new red-black tree implementation in malloc, which drops
memory usage by ~0.5 or ~1%, for 32- and 64-bit systems, respectively.

Don't forget to free() currency_symbol and asciivalue when multiple
conversion specifiers for them are present.

Submitted by: Maxim Dounin <mdounin@mdounin.ru>
Obtained from: NetBSD (partially)
MFC after: 3 days

Better strfmon(3) conversion specifiers sanity checking.

There were no checks for left and right precisions at all, and
a check for field width had integer overflow bug.

Reported by: Maksymilian Arciemowicz
Security: http://securityreason.com/achievement_securityalert/53
Submitted by: Maxim Dounin <mdounin@mdounin.ru>
MFC after: 3 days

Use calloc() instaed of zeroing memory ourselves.

Remove stale #include <machine/atomic.h>, which as needed by lazy
deallocation.

Replace the use of warnx() with direct output to stderr using _write().
This reduces the size of a statically-linked binary by approximately 100KB
in a trivial "return (0)" test application. readelf -S was used to verify
that the .text section was reduced and that using strlen() saved a few
more bytes over using sizeof(). Since the section of code is only called
when environ is corrupt (program bug), I went with fewer bytes over fewer
cycles.

I made minor edits to the submitted patch to make the output resemble
warnx().

Submitted by: kib bz
Approved by: wes (mentor)
MFC after: 5 days

Fix a race condition in arena_ralloc() for shrinking in-place large
reallocation, when junk filling is enabled. Junk filling must occur
prior to shrinking, since any deallocated trailing pages are immediately
available for use by other threads.

Reported by: Mats Palmgren <mats.palmgren@bredband.net>

Remove support for lazy deallocation. Benchmarks across a wide range of
allocation patterns, number of CPUs, and MALLOC_OPTIONS settings indicate
that lazy deallocation has the potential to worsen throughput dramatically.
Performance degradation occurs when multiple threads try to clear the lazy
free cache simultaneously. Various experiments to avoid this bottleneck
failed to completely solve this problem, while adding yet more complexity.

Fix a bug in lazy deallocation that was introduced when
arena_dalloc_lazy_hard() was split out of arena_dalloc_lazy() in revision
1.162.

Reduce thundering herd problems in lazy deallocation by randomly varying
how many probes a thread does before taking the slow path.

Clean up manipulation of chunk page map elements to remove some tenuous
assumptions about whether bits are set at various times. This makes
adding other flags safe.

Reorganize functions in order to inline i{m,c,p,s,re}alloc(). This
allows the entire fast-path call chains for malloc() and free() to be
inlined. [1]

Suggested by: [1] Stuart Parmenter <stuart@mozilla.com>

Track dirty unused pages so that they can be purged if they exceed a
threshold, according to the 'F' MALLOC_OPTIONS flag. This obsoletes the
'H' flag.

Try to realloc() large objects in place. This substantially speeds up
incremental large reallocations in the common case.

Fix a bug in arena_ralloc() that caused relocation of sub-page objects
even if the old and new sizes were in the same size class.

Maintain trees of runs and simplify the per-chunk page map. This allows
logarithmic-time searching for sufficiently large runs in
arena_run_alloc(), whereas the previous algorithm required linear time
in the worst case.

Break various large functions into smaller sub-functions, and inline
only the functions that are in the fast path for small object
allocation/deallocation.

Remove an unnecessary check in base_pages_alloc_mmap().

Avoid integer division in choose_arena() for the NO_TLS case on
single-CPU systems.

Remove some now-unused macros.

MFC after: 1 week

Put back the openpty(3) and ptsname(3) fixes but don't disable ptsname(3)
on pts(4) devices this time. This fixes the issues while leaving pts(4)
enabled on HEAD.

Back out last commit, since it accidentally broke pts.

The security fix will be re-committed soon, hopefully without breaking
anything.

Fix issues which allow snooping on ptys. [08:01]

Fix an off-by-one error in inet_network(3). [08:02]

Security: FreeBSD-SA-08:01.pty
Security: FreeBSD-SA-08:02.libc

Changing 'r' to a size_t in the previous commit turned quicksort
into slowsort for some sequences because different parts of the
code used 'r' to store two different things, one of which was
signed. Clean things up by splitting 'r' into two variables, and
use a more meaningful name.

Use size_t to avoid overflow when sorting arrays larger than 2 GB.

PR: 111085
MFC after: 2 weeks

Enable both sbrk(2)- and mmap(2)-based memory acquisition methods by
default. This has the disadvantage of rendering the datasize resource
limit irrelevant, but without this change, legitimate uses of more
memory than will fit in the data segment are thwarted by default.

Fix chunk_alloc_mmap() to work correctly if initial mapping is not
chunk-aligned and mapping extension fails.

Fix a major chunk-related memory leak in chunk_dealloc_dss_record(). [1]

Clean up DSS-related locking and protect all pertinent variables with
dss_mtx (remove dss_chunks_mtx). This fixes race conditions that could
cause chunk leaks.

Reported by: [1] kris

Fix a bug related to sbrk() calls that could cause address space leaks.
This is a long-standing bug, but until recent changes it was difficult
to trigger, and even then its impact was non-catastrophic, with the
exception of revision 1.157.

Optimize chunk_alloc_mmap() to avoid the need for unmapping pages in the
common case. Thanks go to Kris Kennaway for a patch that inspired this
change.

Do not maintain a record of previously mmap'ed chunk address ranges.
The original intent was to avoid the extra system call overhead in
chunk_alloc_mmap(), which is no longer a concern. This also allows some
simplifications for the tree of unused DSS chunks.

Introduce huge_mtx and dss_chunks_mtx to replace chunks_mtx. There was
no compelling reason to use the same mutex for these disjoint purposes.

Avoid memset() for huge allocations when possible.

Maintain two trees instead of one for tracking unused DSS address
ranges. This allows scalable allocation of multi-chunk huge objects in
the DSS. Previously, multi-chunk huge allocation requests failed if the
DSS could not be extended.

Back out premature commit of previous version.

Maintain two trees instead of one (old_chunks --> old_chunks_{ad,szad}) in
order to support re-use of multi-chunk unused regions within the DSS for
huge allocations. This generalization is important to correct function
when mmap-based allocation is disabled.

Avoid zeroing re-used memory in the DSS unless it really needs to be
zeroed.

Release chunks_mtx for all paths through chunk_dealloc().

Reported by: kris

Add the 'D' and 'M' run time options, and use them to control whether
memory is acquired from the system via sbrk(2) and/or mmap(2). By default,
use sbrk(2) only, in order to support traditional use of resource limits.
Additionally, when both options are enabled, prefer the data segment to
anonymous mappings, in order to coexist better with large file mappings
in applications on 32-bit platforms. This change has the potential to
increase memory fragmentation due to the linear nature of the data
segment, but from a performance perspective this is mitigated by the use
of madvise(2). [1]

Add the ability to interpret integer prefixes in MALLOC_OPTIONS
processing. For example, MALLOC_OPTIONS=lllllllll can now be specified as
MALLOC_OPTIONS=9l.

Reported by: [1] rwatson
Design review: [1] alc, peter, rwatson

Clean up some of the pts(4) vs pty(4) stuff in grantpt(3) and friends:
- Use PTY* for all pty(4) related constants.
- Use PTMX* for all pts(4) related constants.
- Consistently use _PATH_DEV PTMX rather than "/dev/ptmx".
- Revert 1.7 and properly fix it by using the correct prefix string for
pts(4) masters.

MFC after: 3 days

Use fixed point integer math instead of floating point math when
calculating run sizes. Use of the floating point unit was a potential
pessimization to context switching for applications that do not otherwise
use floating point math. [1]

Reformat cpp macro-related comments to improve consistency.

Submitted by: das

Refactor features a bit in order to make it possible to disable lazy
deallocation and dynamic load balancing via the MALLOC_LAZY_FREE and
MALLOC_BALANCE knobs. This is a non-functional change, since these
features are still enabled when possible.

Clean up a few things that more pedantic compiler settings would cause
complaints over.

Implement and document nan(), nanf(), and nanl(). This commit
adds two new directories in msun: ld80 and ld128. These are for
long double functions specific to the 80-bit long double format
used on x86-derived architectures, and the 128-bit format used on
sparc64, respectively.

Update posix_openpt(3) to handle 512 ptys. This was missed in the earlier
pty(4) changes.

MFC after: 3 days

Fix typo in the comment

Only zero large allocations when necessary (for calloc()).

Document the B and L MALLOC_OPTIONS.

Implement dynamic load balancing of thread-->arena mapping, based on lock
contention. The intent is to dynamically adjust to load imbalances, which
can cause severe contention.

Use pthread mutexes where possible instead of libc "spinlocks" (they aren't
actually spin locks). Conceptually, this change is meant only to support
the dynamic load balancing code by enabling the use of spin locks, but it
has the added apparent benefit of substantially improving performance due to
reduced context switches when there is moderate arena lock contention.

Proper tuning parameter configuration for this change is a finicky business,
and it is very much machine-dependent. One seemingly promising solution
would be to run a tuning program during operating system installation that
computes appropriate settings for load balancing. (The pthreads adaptive
spin locks should probably be similarly tuned.)

Implement lazy deallocation of small objects. For each arena, maintain a
vector of slots for lazily freed objects. For each deallocation, before
doing the hard work of locking the arena and deallocating, try several times
to randomly insert the object into the vector using atomic operations.

This approach is particularly effective at reducing contention for
multi-threaded applications that use the producer-consumer model, wherein
one producer thread allocates objects, then multiple consumer threads
deallocate those objects.

Avoid re-zeroing memory in calloc() when possible.

Fix stats printing of the amount of memory currently consumed by huge
allocations. [1]

Fix calculation of the number of arenas when 'n' is specified via
MALLOC_OPTIONS.

Clean up various style inconsistencies.

Obtained from: [1] NetBSD

Remove out of date notes, the atoi code is thread-safe and async-cancel
safe.

Discussed with: desichen

The precision for a string argument in a call to warnx() needs to be cast
to an int to remove the warning from using a size_t variable on 64-bit
platforms.

Submitted by: Xin LI <delphij@FreeBSD.org>
Approved by: wes
Approved by: re (kensmith)

Skip rebuilding environ in setenv() only upon reuse of an active variable;
inactive variables should cause a rebuild of environ, otherwise, exec()'d
processes will be missing a variable in environ that has been unset then
set.

Submitted by: Taku Yamamoto <taku@tackymt.homeip.net>
Reviewed by: ache
Approved by: wes (mentor)
Approved by: re (kensmith)

Added environ-replacement detection. For programs that "clean" (i.e., su)
or replace (i.e., zdump) the environment after a call to setenv(), putenv()
or unsetenv() has been made, a few changes were made.
- getenv() will return the value from the new environ array.
- setenv() was split into two functions: __setenv() which is most of the
previous setenv() without checks on the name and setenv() which
contains the checks before calling __setenv().
- setenv(), putenv() and unsetenv() will unset all previous values and
call __setenv() on all entries in the new environ array which in turn
adds them to the end of the envVars array. Calling __setenv() instead
of setenv() is done to avoid the temporary replacement of the '=' in a
string with a NUL byte. Some strings may be read-only data.

Added more regression checks for clearing the environment array.

Replaced gettimeofday() with getrusage() in timing regression check for
better accuracy.

Fixed an off-by-one bug in __remove_putenv() in the use of memmove(). This
went unnoticed due to the allocation of double the number of environ
entries when building envVars.

Fixed a few spelling mistakes in the comments.

Reviewed by: ache
Approved by: wes
Approved by: re (kensmith)

Significantly reduce the memory leak as noted in BUGS section for
setenv(3) by tracking the size of the memory allocated instead of using
strlen() on the current value.

Convert all calls to POSIX from historic BSD API:
- unsetenv returns an int.
- putenv takes a char * instead of const char *.
- putenv no longer makes a copy of the input string.
- errno is set appropriately for POSIX. Exceptions involve bad environ
variable and internal initialization code. These both set errno to
EFAULT.

Several patches to base utilities to handle the POSIX changes from
Andrey Chernov's previous commit. A few I re-wrote to use setenv()
instead of putenv().

New regression module for tools/regression/environ to test these
functions. It also can be used to test the performance.

Bump __FreeBSD_version to 700050 due to API change.

PR: kern/99826
Approved by: wes
Approved by: re (kensmith)

Add information about the implications of using mmap(2) instead of sbrk(2).

Submitted by: bmah, jhb

Fix junk/zero filling for realloc(). Junk filling was missing in one case,
and zero filling was broken in a way that could cause memory corruption.

Update comments.

Backout 1.5 as requested by deischen

__cleanup() is needed for ports/devel/valgrind, export it.

Back out all POSIXified *env() changes.

Not because I admit they are technically wrong and not because of bug
reports (I receive nothing). But because I surprisingly meets so
strong opposition and resistance so lost any desire to continue that.

Anyone who interested in POSIX can dig out what changes and how
through cvs diffs.

Bump .Dd

Suggested by: Henrik Brix Andersen <henrik@brixandersen.dk>

Add phrase
"so altering the argument shall change the environment."
into putenv description.

Make putenv() fully conforms to Open Group specs Issue 6
(also IEEE Std 1003.1-2001)

The specs explicitly says that altering passed string
should change the environment, i.e. putenv() directly puts its arg
into environment (unlike setenv() which just copies it there).
It means that putenv() can't be implemented via setenv()
(like we have before) at all. Putenv() value lives (allows modifying)
up to the next putenv() or setenv() call.

Remove special case skipping initial '=' of the setenv() value "for
compatibility with the different environment conventions" (man page).
With the standards, we don't have them different anymore and
IEEE Std 1003.1-2001 says that

"The values that the environment variables may be assigned are not
restricted except that they are considered to end with a null byte"

Make setenv, putenv, getenv and unsetenv conforming to Open Group specs
Issue 6 (also IEEE Std 1003.1-2001) in following areas:
args, return, errors.

Putenv still needs rewriting because specs explicitly says that
altering passed string later should change the environment (currently we
copy the string so can't provide that).

Use C comments since we now preprocess these files with CPP.

Swap "underflow"/"overflow" in the table header.

Submitted by: Ricardo Nabinger Sanchez
MFC after: 3 days

Use size_t instead of unsigned for pagesize-related values, in order to
avoid downcasting issues. In particular, this change fixes
posix_memalign(3) for alignments greater than 2^31 on LP64 systems.

Make sure that NDEBUG is always set to be compatible with MALLOC_DEBUG. [1]

Reported by: [1] Lee Hyo geol <hyogeollee@gmail.com>

Remove the run promotion/demotion machinery. Replace it with red-black
trees that track all non-full runs for each bin. Use the red-black
trees to be able to guarantee that each new allocation is placed in the
lowest address available in any non-full run. This change completes the
transition to allocating from low addresses in order to reduce the
retention of sparsely used chunks.

If the run in current use by a bin becomes empty, deallocate the run
rather than retaining it for later use. The previous behavior had the
tendency to spread empty runs across multiple chunks, thus preventing
the release of chunks that were completely unused.

Generalize base_chunk_alloc() (and rename it to base_pages_alloc()) to
handle allocation sizes larger than the chunk size, so that it is
possible to support chunk sizes that are smaller than an arena object.

Reduce the minimum chunk size from 64kB to 8kB.

Optimize tracking of addresses for deleted chunks.

Fix a statistics bug for huge allocations.

Update the IMPLEMENTATION NOTES section to reflect recent malloc
enhancements.

Add a HISTORY section.

Fix some subtle bugs for posix_memalign() having to do with integer
rounding and overflow. Carefully document what the various overflow
tests actually detect.

The bugs mostly canceled out, such that the worst possible failure
cases resulted in non-fatal over-allocations.

Fix posix_memalign() for large objects. Now that runs are extents rather
than binary buddies, the alignment guarantees are weaker, which requires
a more complex aligned allocation algorithm, similar to that used for
alignment greater than the chunk size.

Reported by: matteo

Use extents rather than binary buddies to track free pages within
chunks. This allows runs to be any multiple of the page size. The
primary advantage is that large objects are no longer constrained to be
2^n pages, which can dramatically decrease internal fragmentation for
large objects. This also allows the sizes for runs that back small
objects to be more finely tuned.

Free runs are searched for linearly using the chunk page map (with the
help of some heuristic optimizations). This changes the allocation
policy from "first best fit" to "first fit". A prototype red-black tree
implementation for tracking free runs that implemented "first best fit"
did not cause a measurable speed or memory usage difference for
realistic chunk sizes (though of course it is possible to construct
benchmarks that favor one allocation policy over another).

Refine the handling of fullness constraints for small runs to be more
tunable.

Restructure the per chunk page map to contain only two fields per entry,
rather than four. Also, increase each entry from 4 to 8 bytes, since it
allows for 32-bit integers, without increasing the number of chunk
header pages.

Relax the maximum chunk size constraint. This is of no practical
interest; it is merely fallout from the chunk page map restructuring.

Revamp statistics gathering and reporting to be faster, clearer and more
informative. Statistics gathering is fast enough now to have little
to no impact on application speed, but it still requires approximately
two extra pages of memory per arena (per process). This memory overhead
may be acceptable for most systems, but we still need to leave
statistics gathering disabled by default in RELENG branches.

Rename NO_MALLOC_EXTRAS to MALLOC_PRODUCTION in order to make its intent
clearer (i.e. it should be defined in RELENG branches).

Avoid using vsnprintf(3) unless MALLOC_STATS is defined, in order to
avoid substantial potential bloat for static binaries that do not
otherwise use any printf(3)-family functions. [1]

Rearrange arena_run_t so that the region bitmask can be minimally sized
according to constraints related to each bin's size class. Previously,
the region bitmask was the same size for all run headers, which wasted
a measurable amount of memory.

Rather than making runs for small objects as large as possible, make
runs as small as possible such that header overhead stays below a
certain bound. There are two exceptions that override the header
overhead bound:

1) If the bound is impossible to honor, it is relaxed on a
per-size-class basis. Since there is one bit of header
overhead per object (plus a constant), it is impossible to
achieve a header overhead less than or equal to 1/(# of bits
per object). For the current setting of maximum 0.5% header
overhead, this relaxation comes into play for {2, 4, 8,
16}-byte objects, for which header overhead is (on 64-bit
systems) {7.1, 4.3, 2.2, 1.2}%, respectively.

2) There is still a cap on small run size, still set to 64kB.
This comes into play for {1024, 2048}-byte objects, for which
header overhead is {1.6, 3.1}%, respectively.

In practice, this reduces the run sizes, which makes worst case
low-water memory usage due to fragmentation less bad. It also reduces
worst case high-water run fragmentation due to non-full runs, but this
is only a constant improvement (most important to small short-lived
processes).

Reduce the default chunk size from 2MB to 1MB. Benchmarks indicate that
the external fragmentation reduction makes 1MB the new sweet spot (as
small as possible without adversely affecting performance).

Reported by: [1] kientzle

Modify chunk_alloc() to prefer mmap()ed memory over sbrk()ed memory.
This has no impact unless USE_BRK is defined (32-bit platforms), in
which case user allocations are allocated via mmap() if at all possible,
in order to avoid the possibility of unreclaimable chunks in the data
segment.

Fix an obscure bug in base_alloc() that could have allowed undefined
behavior if an application were to use sbrk() in conjunction with a
USE_BRK-enabled malloc.

Fix a utrace(2)-related bug in calloc(3).

Integrate various pedantic cleanups.

Submitted by: Andrew Doran <ad@netbsd.org>

Per Regents of the University of Calfornia letter, remove advertising
clause.

# If I've done so improperly on a file, please let me know.

Implement chunk allocation/deallocation hysteresis by caching one spare
chunk per arena, rather than immediately deallocating all unused chunks.
This fixes a potential performance issue when allocating/deallocating
an object of size (4kB..1MB] in a loop.

Reported by: davidxu

Note that the value from getenv() should not be modified by applications.

PR: 60544
Reviewed by: ru

getenv.3: Put "is" on a line with other words
getobjformat.3: "takes precedence over" is not an envrionment variable.

PR: 75545
Submitted by: n-kogane@syd.odn.ne.jp
MFC after: 3 days

Revise markup in recently added manpages.

Keep compatible parts in sync with OpenBSD v1.21, add some comments.
No functional changes.

Remove code #ifndef'ed in prev. commit to stay in sync with OpenBSD
v1.21 which just do that.

Be more GNU compatible:
don't be greedy on the GNU "::" extension when arg separated by whitespace
and POSIX_CORRECTLY is set. From POSIX point of view this is unclear
situation, so minimal assumption looks right.

Markup fixes.

Change the way base allocation is done for internal malloc data
structures, in order to avoid the possibility of attempted recursive
lock acquisition for chunks_mtx.

Reported by: Slawa Olhovchenkov <slw@zxy.spb.ru>

alloca() cannot check if the allocation is valid; mention the consequences.

Obtained from: OpenBSD

Enable TLS on PowerPC.

Enable TLS on ia64.

Correctly handle the case in calloc(num, size) where
(size_t)(num * size) == 0
but both num and size are nonzero.

Reported by: Ilja van Sprundel
Approved by: jasone
Security: Integer overflow; calloc was allocating 1 byte in
response to a request for a multiple of 2^32 (or 2^64)
bytes instead of returning NULL.

Define NO_TLS on PowerPC.

See also: PR ia64/91846

Conditionally expand the size_invs lookup table in arena_run_reg_dalloc()
so that architectures with a quantum of 8 (rather than 16) work.

Restore arm's quantum to 8.

Submitted by: jmg

Use 4 as QUANTUM_2POW_MIN on arm as it is on any other architecture, to avoid
triggering an assertion later.

Fix cpp logic in arena_malloc() to adjust size when assertions are enabled,
even if stats gathering is disabled. [1]

Remove 'size' parameter from several functions that do not use it.

Reported by: [1] ache

Use some math tricks in arena_run_reg_dalloc() to avoid actual division, as
well as avoiding a switch statement. This change has no significant impact
to performance when branch prediction is successful at predicting the sizes
of objects passed to free(), but in the case that the object sizes are
semi-random, this change has the potential to prevent many branch prediction
misses, thus improving performance substantially.

Take advantage of alignment guarantees in ipalloc(), and pad object sizes to
something less than a power of two when possible. This has the potential
to substantially reduce internal fragmentation for objects allocated via
posix_memalign().

Avoid an unnecessary pow2_ceil() call in arena_ralloc().

Submitted by: djam8193ah@hotmail.com

Make the behavior of malloc(0) standards-compliant by getting rid of nil,
and instead creating a small allocation for each malloc(0) call. The
optional SysV compatibility behavior remains unchanged.

Add a couple of assertions.

Fix a couple of typos in error message strings.

twalk() expects an `action' function not a comparison function.
The text is correct in the "DESCRIPTION" section, so fix "SYNOPSIS"
to use the correct name.

PR: docs/90498
Submitted by: Vasil Dimov
MFC after: 3 days

Add a missing case for the switch statement in arena_run_reg_dalloc(). [1]

Fix a leak in chunk_dealloc(). [2]

Reported by: [1] djam8193ah@hotmail.com,
[2] Ville-Pertti Keinonen <will@exomi.com>

o .Xr strtonum(3).

MFC after: 1 week

Correct decoding a string containing '/'.

PR: 97485
Submitted by: Mikko Tyolajarvi < mbsd at pacbell dot net >

Increase the minimum chunk size by a power of two (32kB --> 64kB, assuming
4kB pages), in order to avoid dangerous rounding error when calculating
fullness limits during run promotion/demotion.

Convert a structure bitfield to a normal field in areana_run_t. This should
have been changed along with the other fields in revision 1.120.

Change the semantics of brk_max to dynamically deal with data segment
bounds. [1]

Modify logic for utilizing the data segment, such that it is possible to
create huge allocations there.

Shrink the data segment when deallocating a chunk, if it is at the end of
the data segment.

Rename chunk_size to csize in huge_malloc(), in order to avoid masking a
static variable of the same name. [1]

Reported by: Paul Allen <nospam@ugcs.caltech.edu>

s/soley/solely

Add an unreachable return statement, in order to avoid a compiler warning
for non-standard optimization levels.

Reported by: Michael Zach <zach@webges.com>

Only initialize the first per-chunk page map element for free runs. This
makes run split/coalesce operations of complexity lg(n) rather than n.

Add malloc_usable_size() to the RETURN VALUES section.

Add init_lock, and use it to protect against allocator initialization
races. This isn't currently necessary for libpthread or libthr, but
without it external threads libraries like the linuxthreads port are
not safe to use.

Reported by: ganbold@micom.mng.net

Refactor per-run bitmap manipulation functions so that bitmap offsets only
have to be calculated once per allocator operation.

Make nil const.

Update various comments.

Remove/avoid division where possible.

For the one division operation that remains in the critical path, add a
switch statement that has a case for each small size class, and do division
with a constant divisor in each case. This allows the compiler to generate
optimized code that does not use hardware division [1].

Obtained from: peter [1]

Optimize runtime performance, primary using the following techniques:

* Avoid choosing an arena until it's certain that an arena is needed
for allocation.

* Convert division/multiplication to bitshifting where possible.

* Avoid accessing TLS variables in single-threaded code.

* Reduce the amount of pointer dereferencing.

* Move lock acquisition in critical paths to only protect the the code
that requires synchronization, and completely remove locking where
possible.

Add malloc_usable_size(3).

Discussed with: arch@

Allow the 'n' option to decrease the number of arenas below the default,
to as little as one arena. Also, limit the number of arenas to avoid a
potential invariant violation in base_alloc().

Add comments and reformat/rearrange code. There are no significant
functional changes in this commit.

Convert TINY_MIN_2POW from a cpp macro to tiny_min_2pow (a variable), and
determine its value at run time according to other relevant values. This
avoids the creation of runs that are incompletely utilized, as long as
pagesize isn't too large (>32kB, given the current RUN_MIN_REGS_2POW
setting).

Increase the size of several structure bitfields in arena_run_t in order
to avoid integer overflow in the case that a run's header does not overlap
with the space that is usable as application allocation regions. Given
the tiny_min_2pow change, this fix has no additional impact unless
pagesize is >32kB.

Reported by: kris

Add USE_BRK-specific code in malloc_init_hard() to allow the first
internally used chunk to start at the beginning of the heap, rather
than at a chunk-aligned address. This reduces mapped memory somewhat
for 32-bit architectures.

Add the arena_run_link_t type and use it wherever a run object is only
used as a ring 'header'. This saves approximately 40 kB of memory per
arena.

Remove an obsolete (no longer used) code path from base_alloc(), which
supported the internal allocation of objects larger than the chunk
size.

Enhance chunk_dealloc() to cache chunk addresses for all deallocated
chunks. This has no impact for most programs, but has the potential
to reduce VM map fragmentation for programs that use huge
allocations.

Separate completely full runs from runs that are merely almost full, so
that no linear searching is necessary if we resort to allocating from a
run that is known to be mostly full. There are pathological edge cases
that could have caused severely degraded performance, and this change
fixes that.

Optimize realloc() to reallocate in place if the old and new sizes are
close enough to each other that reallocation would allocate a new region
of the same size. This improves the performance of repeated incremental
reallocations by up to three orders of magnitude. [1]

Fix arena_new() to properly constrain run size if a small chunk size was
specified during runtime configuration.

Suggested by: se [1]

Modify allocation policy, in order to avoid excessive fragmentation for
allocation patterns that involve a relatively even mixture of many
different size classes.

Reduce the chunk size from 16 MB to 2 MB. Since chunks are now carved up
using an address-ordered first best fit policy, VM map fragmentation is
much less likely, which makes smaller chunks not as much of a risk. This
reduces the virtual memory size of most applications.

Remove redzones, since program buffer overruns are no longer as likely to
corrupt malloc data structures.

Remove the C MALLOC_OPTIONS flag, and add H and S.

Add a non-optional newline after ".Bx".

Revert previous changes as we do support the .Ox macro for OpenBSD.

Pointed out by: ceri, ru, delphij

POSIXed strtoll() (and ours one too) can set errno to EINVAL, so check
it first.

Approved by: andre

Fix HISTORY and point to OpenBSD.

Import of OpenBSD's strtonum(3) which is a nicer version of strtoll(3)
providing proper error checking and other improvements.

Obtained from: OpenBSD
Requested by: flz (to port Open[BGP|OSPF]D)
MFC after: 3 days

Add each directory's symbol map file to SYM_MAPS.

Add symbol maps and initial symbol version definitions to libc.

Reviewed by: davidxu

Fix typo in manual page reference.

Approved by: cognet (mentor)
MFC after: 3 days

Remove extra slash from pty slave device name returned by ptsname.

Fix calculation of the number of arenas to use on multi-processor systems.

Expand contractions.

If the sysctl kern.pts.enable doesn't exist, check that /dev/ptmx is there,
and if so, use the pts system.

Suggested by: rwatson

Remove unwarranted uses of 'goto'.

Add NO_MALLOC_EXTRAS, so that various extra features that can cause
performance degradation can be disabled via something like the following
in /etc/malloc.conf:

CFLAGS+=-DNO_MALLOC_EXTRAS

Suggested by: deischen

Fix the type of a statistics counter (unsigned --> unsigned long).

Clean up statistics gathering and printing.

Optimize arena_bin_pop() to reduce the number of separator operations.
Remove the block of code that tries to use delayed regions in LIFO order,
since from a policy perspective, it conflicts with LRU caching of newly
coalesced regions in arena_undelay(). There are numerous policy
alternatives, and it isn't readily obvious which (if any) is superior;
this change at least has the virtue of being consistent with policy.

ptsname() bits for pts.

Remove a redundant variable assignment in arena_reg_frag_alloc().

If no coalesced exact-fit small regions are available, but delayed exact-
fit regions are available, use the delayed regions in LIFO order, in order
to increase locality of reference. We might expect this to cause delayed
regions to be removed from the delay ring buffer more often (since we're
now re-using more recently buffered regions), but numerous tests indicate
that the overall impact on memory usage tends to be good (reduced
fragmentation).

Re-work arena_frag_reg_alloc() so that when large free regions are
exhausted, it uses small regions in a way that favors contiguous allocation
of sequentially allocated small regions. Use arena_frag_reg_alloc() in
this capacity, rather than directly attempting over-fitting of small
requests when no large regions are available.

Remove the bin overfit statistic, since it is no longer relevant due to
the arena_frag_reg_alloc() changes.

Do not specify arena_frag_reg_alloc() as an inline function. It is too
large to benefit much from being inlined, and it is also called in two
places, only one of which is in the critical path (the other call bloated
arena_reg_alloc()).

Call arena_coalesce() for a region before caching it with
arena_mru_cache().

Add assertions that detect the attempted caching of adjacent free regions,
so that we notice this problem when it is first created, rather than in
arena_coalesce(), when it's too late to know how the problem arose.

Reported by: Hans Blancke

Make the 'C' and 'c' malloc options consistent with other options; 'C'
doubles the cache size, and 'c' halves the cache size.

In arena_chunk_reg_alloc(), try to avoid touching the last page in the
chunk during initialization, in order to avoid physically backing the
page unless data are allocated there.

Use uintptr_t rather than size_t when casting pointers to integers. Also,
fix the few remaining casting style(9) errors that remained after the
functional change.

Reported by: jmallett

Revert addtion of assertions in revision 1.99. These assertions cause
problems in cases where regions are faked up for the purposes of red-black
tree searches, since those faked region headers reside on the stack, rather
than in a malloc chunk.

Add assertions that detect some forms of region separator corruption.

Remove loops in arena_coalesce(). They are no longer necessary, now that
internal allocation does not rely on recursive arena use (base_arena was
removed in revision 1.95).

Make all internal variables and functions static.

Reported by: ache

Return NULL if there is an OOM error during initialization, rather than
allowing the error to be fatal.

Move a label in order to make sure to properly handle errors in malloc(0).

Reported by: Alastair D'Silva, Saneto Takanori

Add a separate simple internal base allocator and remove base_arena, so that
there is never any need to recursively call the main allocation functions.

Remove recursive spinlock support, since it is no longer needed.

Allow chunks to be as small as the page size.

Correctly propagate OOM errors from arena_new().

Define NO_TLS on ia64. The dynamic TLS implementation on ia64 is
broken for non-threaded shared processes in that __tls_get_addr()
assumes the thread pointer is always initialized. This is not the
case. When arenas_map is referenced in choose_arena() and it is
defined as a thread-local variable, it will result in a SIGSEGV.

PR: ia64/91846 (describes the TLS/ia64 bug).

Replace malloc(), calloc(), posix_memalign(), realloc(), and free() with
a scalable concurrent allocator implementation.

Reviewed by: current@
Approved by: phk, markm (mentor)

Fix a bitwise logic error in posix_memalign().

Reported by: glebius

In preparation for a new malloc implementation:

* Add posix_memalign().

* Move calloc() from calloc.c to malloc.c. Add a calloc() implementation in
rtld-elf in order to make the loader happy (even though calloc() isn't
used in rtld-elf).

* Add _malloc_prefork() and _malloc_postfork(), and use them instead of
directly manipulating __malloc_lock.

Approved by: phk, markm (mentor)

Add a64l(), l64a(), and l64a_r() XSI extentions. These functions convert
between a 32-bit integer and a radix-64 ASCII string. The l64a_r() function
is a NetBSD addition.

PR: 51209 (based on submission, but very different)
Reviewed by: bde, ru

Fix prototype.

Include a couple of headers to ensure consistency between the prototype and
the function definition.

Move the declaration of __cleanup to libc_private.h as it is used in both
stdio/ and stdlib/. Don't define __cleanup twice.

Fix ptsname(3) by converting it to use devname(3) to obtain the name of
a tty device instead of the legacy minor number approach. This is known to
fix gnome-vfs' sftp module as well as kio_sftp and kdesu on -CURRENT.

Thanks to scottl for the snprintf() approach idea.

Reviewed by: phk
Tested by: pav
mich
Approved by: re (scottl)

Do not require the pty(4) majors to be anything in particular.

Remove the check about whether MALLOC_EXTRA_SANITY is defined,
surrounding the undef'ing it. It does not seem necessary to
undef some symbol that is not exist, and gcc does not complain
about whether a symbol is exist before #undef'ing it out.

Spotted by: mingyanguo via ChinaUnix.net forum
Reviewed by: phk

Especially mention that setting errno to EINVAL in "no conversion" case
is not portable.

Asked by: joerg

Whitespace/style tweaking of prev. commit.

Noted by: bde

POSIX says that 0[xX] prefix is _optional_ even in base 16 case, make it
really so.

"If the value of base is 16, the characters 0x or 0X may optionally
precede the sequence of letters and digits, following the sign if
present."

Found by: joerg

Sort sections.

Markup fixes.

Fix some signed/unsigned comparisons. Fix prototypes while I'm here.

PR: 28890
Submitted by: matthias.andree at web dot de
MFC after: 7 days

sranddev() is not magic pixie dust. While it gives a good random
seed, the random number generator rand(3) still sucks and is unlikely
sufficient for crypto use. Correct what appears to be a cut and paste
error from the srandomdev() man page.

Submitted by: Ben Mesander

Reword recent addition about memory moving.

Requested by: keramida

Bump .Dd

Requested by: ru

Clarify that realloc and reallocf may move the memory allocation.

Use #include <unistd.h> rather than the explicit externs in the
example. The externs haven't been needed in about 10 years, so
there's no reason to have them other than for hysterical raisins. And
the California Rasins haven't been around for a long time...

mdoc(7) fixes.

Move the return value information about the getenv(3) library function
under the RETURN VALUES section so it is consistent with others.

Cleanup the return value text for getenv(3) a little while I am here.

PR: docs/58033
MFC after: 3 days

Keep it sync with OpenBSD:
An optional argument cannot start with '-', even if permutation is
disabled.

Obtained from: OpenBSD getopt_long.c v1.17

Sort SEE ALSO references (in dictionary order, ignoring case).

Consistently use __inline instead of __inline__ as the former is an empty macro
in <sys/cdefs.h> for compilers without support for inline.

Eliminate double whitespace.

Mechanically kill hard sentence breaks.

Define malloc_pageshift and malloc_minsize for arm.

Link radixsort(3) to sradixsort(3), make the latter appear in
the whatis(1) output.

Simplify one condition in prev. commit:
short_too already assumes FLAG_LONGONLY

Fix parsing of ambiguous options, whole loop must be processed

Rearrange (centralize) initialization of mallocs internals to always be
done before the first call, even if this is a malloc(0) call.

PR: 62859

Merge some fixes from NetBSD's getopt.3 v1.31:
cleanup, add more sections, better explanation, declaration

Merge some fixes from NetBSD's getopt.c v1.26:
cleanups, handling 'ls -l-', handling '--*'

Note this is in the same time back out of our v1.3
"Don't print an error message if the bad option is '?'"
because it directly violates POSIX.

Fix typo, was 'W'; instead of `W;'

Make GNU-compatible following case:
single '-' in command line and '-' (non-first) in options

Make return code in noarg case GNU-compatible

Be more GNU-compatible in diagnostics

Improve GNU compatibility in several places, use internal GNU_COMPATIBLE
define for it.
Don't catch POSIXLY_CORRECT env. into static variable, it can be changed
on the fly by program.
Use P1003.2 standartized illoptchar[]

Comment out things related to getopt() replacement we not use

Change "-"-started options when POSIX_CORRECTLY is set handling
in favour of GNU instead of NetBSD, because configure's use us and
expect GNU.

Change "-"-started options when POSIX_CORRECTLY is set handling
in favour of GNU instead of NetBSD, because configure's use us and
expect GNU.

Add getopt_long_only() from OpenBSD and other OpenBSD cleanups

PR: 63173
Submitted by: Marius Strobl <marius@alchemy.franken.de>

Add optarg, optind, opterr, optopt, optreset to SYNOPSYS

POSIX clearly states that getsubopt() should be declared in <stdlib.h>
not in <unistd.h>

Remove unneccessary <unistd.h>

Remove the triplicity in the public functions by vectoring them all
through a realloc like function.

Make the malloc_active variable a local static to this new function.

Don't warn about recursion more than once per base call.

constify malloc_func.

Move the check for sensitive processes to the point where the exception
has been hit, this makes it cover more cases.

Call the message function directly rather than fiddle with flag-saving
when we find an unknown character in our options.

The 'A' flag should not trigger on legal out of memory conditions.

Unbreak the upgrade path from 4.9 after removal of GNU getopt and
<gnuregex.h>.

style cleanup: Remove duplicate $FreeBSD$ tags.

These files had tags after the copyright notice,
inside the comment block (incorrect, removed),
and outside the comment block (correct).

Approved by: rwatson (mentor)

Use 'uint32_t' instead of 'long' when a 32-bit integer is intended.
This results in no functional change, aside from fixing a data
corruption bug on LP64 platforms. The code here could still use a
significant amount of cleanup.

PR: 56502
Submitted by: hrs (earlier version)

Implement __cxa_atexit/__cxa_finalize as specified by the cross-vendor
ó++ ABI document at http://www.codesourcery.com/cxx-abi/abi.html#dso-dtor

The ABI was initially defined for ia64, but GCC3 and Intel compilers
have adopted it on other platforms.

This is the patch from PR bin/59552 with a number of changes by
me.

PR: bin/59552
Submitted by: Bradley T Hughes (bhughes at trolltech dot com)

Implement __cxa_atexit/__cxa_finalize as specified by the cross-vendor
C++ ABI document at http://www.codesourcery.com/cxx-abi/abi.html#dso-dtor

The ABI was initially defined for ia64, but GCC3 and Intel compilers
have adopted it on other platforms.

This is the patch from PR bin/59552 with a number of changes by
me.

PR: bin/59552
Submitted by: Bradley T Hughes (bhughes at trolltech dot com)

Do not adjust to the pagesize at runtime. Besides for the one-time
initialization overhead, there's a problem in that we never call
imalloc() and thus malloc_init() for zero-sized allocations. As a
result, malloc(0) returns NULL when it's the first or only malloc in
the program. Any non-zero allocation will initialize the malloc code
with the side-effect that subsequent zero-sized allocations return a
non-NULL pointer. This is because the pointer we return for zero-
sized allocations is calculated from malloc_pageshift, which needs
to be initialized at runtime on ia64.

The result of the inconsistent behaviour described above is that
configure scripts failed the test for a GNU compatible malloc. This
resulted in a lot of broken ports.

Other, even simpler, solutions were possible as well:
1. initialize malloc_pageshift with some non-zero value (say 13 for
8KB pages) and keep the runtime adjustment.
2. Stop using malloc_pageshift to calculate ZEROSIZEPTR.

Removal of the runtime adjustment was chosen because then ia64 is the
same as any other platform. It is not to say that using a page size
obtained at runtime is bad per se. It's that there's currently a high
level of gratuity for its existence and the moment it causes problems
is the moment you need to get rid of it. Hence, it's not unthinkable
that this commit is (partially) reverted some time in the future when
we do have a good reason for it and a good way to achieve it.

Approved by: re@ (rwatson)
Reported by: kris (portmgr@) -- may the ports be with you

Improve the performance of radixsort() when
sorting strings with common prefixes by noting
when all the strings land in just one bin.

Testing shows significant speedups (on the order of
30%) on strings with common prefixes and no slowdowns on any
of my test cases.

Submitted by: Markus Bjartveit Kruger <markusk@pvv.ntnu.no>
PR: 58860
Approved by: gordon (mentor)

Externalize malloc's spinlock so that a thread library can take
it around an application's fork() call. Our new thread libraries
(libthr, libpthread) can now have threads running while another
thread calls fork(). In this case, it is possible for malloc
to be left in an inconsistent state in the child. Our thread
libraries, libpthread in particular, need to use malloc internally
after a fork (in the child).

Reviewed by: davidxu

Remove incomplete support for running FreeBSD userland on old NetBSD kernels
lacking the issetugid() and utrace() syscalls.

Don peril sensitive (ie: bikeshed sensitive) sunglasses and quietly
send strhash(3) off to sleep with the fishes. Nothing in our tree uses it.
It has no documentation. It is nonstandard and in spite of the filename
strhash.c and strhash.h, it lives in application namespace by providing
compulsory global symbols hash_create()/hash_destroy()/hash_search()/
hash_traverse()/hash_purge()/hash_stats() regardless of whether you
#include <strhash.h> or not. If it turns out that there is a huge
application for this after all, I can repocopy it somewhere safer and
we can revive it elsewhere. But please, not in libc!

Consistently cast to (u_char *) when filling with junk.

Style changes. Inching closer to convergence with OpenBSD.

Cite the published version of "Engineering a Sort Function" instead of
an email address. Spell McIlroy correctly.

More style fixes to improve diffability with OpenBSD.

Pull 'A' evilness for realloc(3) from OpenBSD.

Style changes to improve diffability against OpenBSD version.

Get rid of duplicates.

mdoc(7): Properly mark C headers.

mdoc(7): Use the new feature of the .In macro.

Replace some syscalls with libc version, this makes abort work better with
libkse. Tested under libc_r, libkse, libthr.

Reviewed by: deischen

For type 0 rng lower initial drop to 50, it is enough to hide linearity
Reorganize historic #ifdef section

Cross-reference arc4random(3).

Minor constification.

mdoc(7) fix: Use the normal AT&T macro (.At) rather than its
internal string in the macro context.

mdoc police

Be more specific in BUGS.
Submitted by: ru

Add history.

Assorted mdoc(7) fixes.

Clarify the code a bit.

Submitted by: Nadav Eiron <nadav@TheEirons.org>

Fix grammar bogons.

MFC after: 3 days

Fix stripping last path component when only one path component left.

PR: 52686
MFC after: 1 day

Assorted mdoc(7) fixes.

Approved by: re (blanket)

Back out the `hiding' of strlcpy and strlcat. Several people
vocally objected to this safety belt.

Tell malloc.c that AMD64 uses the same pagesize as i386.

`Hide' strlcpy and strlcat (using the namespace.h / __weak_reference
technique) so that we don't wind up calling into an application's
version if the application defines them.

Inspired by: qpopper's interfering and buggy version of strlcpy

MFp4: Link strtof.3 and strtold.3 to strtod.3.

BDE'ify

fix truncation check and buffer overflow check

- MAXPATHLEN -> PATH_MAX (pass correct buffer size to readlink as well)

Requested by: bde

Make realpath() thread-safe. New implementation does not use chdir(2) at all.

Submitted by: Constantin S. Svintsoff <kostik (at) iclub.nsu.ru>

According to C99 decimal_point can't be empty

The gdtoa import apparently hasn't caused anything or anyone to
explode, so nix the old strtod() / dtoa(). This change is part
of the gdtoa patches reviewed on standards@.

Document strtof() and strtold(). Update vendor license.

Reviewed by: bde (briefly), mike (mentor), obrien

Replace our ancient dtoa/strtod implementation with the gdtoa
package, a more recent, generalized set of routines. Among the
changes:
- Declare strtof() and strtold() in stdlib.h.
- Add glue to libc to support these routines for all kinds
of ``long double''.
- Update printf() to reflect the fact that dtoa works slightly
differently now.

As soon as I see that nothing has blown up, I will kill
src/lib/libc/stdlib/strtod.c. Soon printf() will be able
to use the new routines to output long doubles without loss
of precision, but numerous bugs in the existing code must
be addressed first.

Reviewed by: bde (briefly), mike (mentor), obrien

Document the fact that hdestory calls free on the keys added with
hsearch(.., ENTER). Make the example reflect this.

PR: 49951
Submitted by: Peter Jeremy <peterjeremy@optushome.com.au>

Fix typo.

Use strlcpy instead of strncpy.

Submitted by: imp
Reviewed by: silence on -audit

Back out "drop first N values" method of removing monotonically increased
seed->first value correlation. It breaks rand_r()... Other possible methods
like shuffling inside aray will breaks rand_r() too, because it assumes
only one word state, i.e. nothing extra can be added after seed assignment
in srand().

BTW, for old formulae seed->first value correlation is not so monotonically
increased as with other Linear Congruential Generators of this type only
becase arithmetic overflow happens. But overflow affects distribution
and lower bits very badly, as many articles says, such type of overflow
not improves PRNG.

So, monotonically increased seed->first value correlation problem remains...

Since we drop NSHUFF values now, set default seed to what it becomes
after srand(1)

For rand(3) and random(3) TYPE_0 drop NSHUFF values right after srand{om}()
to remove part of seed -> 1st value correlation. Correlation still remains
because of algorithm limits. Note that old algorithm have even stronger
correlation, especially in the lower bits area, but not eye-visible, as
current one.

Park & Miller PRNG can be safely initialized with any value but 0 and stuck
at 0 as designed. Its BSD adaptation tries to fight it by mapping 0 to
2147483647 after calculation, but this method not works since 2147483647
seed returns to 0 again on the next interation. Instead of after calculation
mapping, map 0 to another value _before_ calculation, so it never stucks.

For some combinations of variable sizes and RAND_MAX value rand_r()
may store less amount bits for seed, than available. Fix it.

Catch some cases where asking for ridiculously large allocations could
result in a segfault. Instead just return NULL.

Add an MLINK malloc.conf(5) -> malloc(3).

For "sensitive" processes, we always set the 'A' flag which causes abort()
to be called on first sight of trouble.

"sensitive" is somewhat arbitrarily defined as "setuid, setgid, uid == root
or gid == wheel".

The 'A' option carries no performance penalty.

It is not possible to override this setting: fix the program instead.

Absentmindedly nodded OK to by: various

realpath(3) should use PATH_MAX instead of MAXPATHLEN according to POSIX.

This also reverts the PATH_MAX -> MAXPATHLEN part of
rev 1.3 of src/bin/realpath/realpath.c

Requested by: imp
Reviewed by: imp, bde

strfmon(3) does not correctly handle multibyte characters in the
format string.

No need to include <assert.h> here.

Fix three warnings:
o #include <stdio.h> to make sprintf()'s prototype visible.
o Remove unused variable: sbuf.
o Don't use assignment as truth value.

style(9): return type on separate line from function name.

Add missing #include "namespace.h".

Remove unused variable: ntmp.

#include <string.h> for strcmp()'s prototype.

Implement POSIX grantpt(3) functionality, and add a pt_chown utility (akin
to Solaris, it is in /usr/libexec) to perform the handing over of tty nodes
to the user being granted the pty.

Submitted by: Ryan Younce <ryany@pobox.com>
Reviewed by: security-officer@, standards@, mike@

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

mdoc(7) police: Deal with self-xrefs.

Document what really occurs when we obtain an error.

PR: 43357
Submitted by: David Schultz <dschultz@uclink.Berkeley.EDU>

mdoc(7) police: "The .Fa argument.".

mdoc(7) police: Fixed abuses of the .Ar and .Em macros.

mdoc(7) police: "The .Fn function".

mdoc(7) police: sort xrefs in SEE ALSO.

Uniformly refer to a file system as "file system".

Approved by: re

mdoc(7) police: overhaul.

Approved by: re

mdoc(7) police: nits.

Approved by: re

Consistently mark std(in|out|err) with .Dv, because that's how they
are marked up in stdio(3), and because they are defined expressions
of type "FILE *".

Approved by: re

mdoc(7) police: sweep.

mdoc(7) police: formatting nits.

Approved by: re

libc_r wasn't so tied to libc for 22 months.

Define `Sudden_Underflow' when compiling for the Alpha
architecture, mainly to avoid getting a SIGFPE signal sent
when calling strtod(3) with certain input.

The SIGFPE has been sent because the code was not aware that
a Gradual Underflow is handled in software via traps on the
Alpha architecture, but is not implemented in our Alpha kernel
layer.

With `Sudden_Underflow' defined, strtod(3) should not depend
on Gradual Underflow and adjust its calculations accordingly,
which means that other, more subtle errors than the sending of
SIGFPE could be solved by this.

Discussed with: bde
PR: alpha/12623
PR: alpha/17032
PR: alpha/43567
MFC after: 7 days

de-__P()

- Remove the lsearch() and lfind() functions and their manpage from
the compatibility library libcompat.
- Add new implementations of lsearch() and lfind() which conform to
IEEE Std 1003.1-2001 to libc. Add a new manual page for them and
add them to the makefile.
- Add function prototypes for lsearch() and lfind() to the search.h
header.

Remove unneeded $FreeBSD$ tags.

- Remove the old insque() and remque() functions and their manual
page from the compatibility library.
- Add new implementations of insque() and remque() which conform to
IEEE Std 1003.1-2001 to libc. Add a new manual page for them and
connect them to the build.
- Add the prototypes of insque() and remque() to the search.h
header.

Fix a typo causing incorrect formatting for negative values in some locales
(at least the French ones), a memory leak upon successful termination, a
pointer arithmetic error causing heap corruption, and an off-by-one bug
causing incorrect amounts of padding at the right of the value.

Save errno around calls to free(); at least some code paths clobber it
and we are not interested in any errors it may report.

Document the kind of format string strfmon() expects. Sync the Errors
section with reality.

Use the new struct lconv members to determine how to format international
monetary values.

Non-negative amounts should not have an extra space in front of them
when the `(' flag is used.

"Left precision" and "right precision" are not flags, but separate parts
of the format string that appear after the field width.

Add cross-references to wide character versions of these functions.

Add missing const qualifier in tfind().

Add getopt_long(3).

Obtained from: NetBSD
Sponsored by: Apple

Add restrict type-qualifier.

Implement C99's _Exit() interface.
Implement a version of qsort that provides a thunk to the comparison function.

Update manual pages.

Include some verbage about not calling exit() from functions registered
by atexit().

Style: One space between "restrict" qualifier and "*".

s/EDOFUS/EDOOFUS/

Persuaded by: Google

- Add the 'restrict' qualifier to the function prototypes and
definitions of the functions that convert strings to numbers
and are defined by IEEE Std 1003-1.2001.
- Use ANSI-C function definitions for all of the functions
mentioned above plus strtouq and strtoq.
- Update the prototypes in the manual pages.

- Add the 'restrict' qualifier to match the IEEE Std 1003.1-2001
prototype of the tdelete(3) function.
- Remove duplicated space.
- Use an ANSI-C function definition for tdelete(3).
- Update the manual page.

Use a union to access the words of a double as this is less likely
to cause bugs when gcc is more aggressively optimising things.

There are still problems with dtoa mentioned in the PR - maybe
Dan could suggest a patch.

PR: 40209
Submitted by: Dan Lukes <dan@obluda.cz>
Approved by: bde
MFC after: 2 weeks

Make sure we set errno sensibly in case of failure.

Spotted by: ache

Nonexistent SIZE_MAX -> SIZE_T_MAX

Signal an error instead of giving the caller less memory than they asked
for when num * size would cause integer overflow.

MFC after: 1 week

Fix some comments.

Remove improper use of <namespace.h>

Clarify the bit about realloc() and its `ptr' argument a bit.
Hopefully, now it is more clear that the memory referenced by the
ptr argument of realloc(ptr,size) is freed and only the return value
of realloc() points to a valid memory area upon successful completion.

Submitted by: Martin Faxer <gmh003532@brfmasthugget.se>

Const poison.

Partially submitted by: wollman

mdoc(7) police: nit.

Assume __STDC__, remove non-__STDC__ code.

Submitted by: keramida

Remove spurious period.

Let this code know about PowerPC.

Avoid casting a different sized integer to a pointer on LP64 systems.

Constify _malloc_options.

Do not use __progname directly (except in [gs]etprogname(3)).
Also, make an internal _getprogname() that is used only inside
libc. For libc, getprogname(3) is a weak symbol in case a
function of the same name is defined in userland.

Fix the style of the SCM ID's.
I believe have made all of libc .h's as consistent as possible.

Fix the style of the SCM ID's.
I believe have made all of libc .c's as consistent as possible.

Remove multi-line __P() usage.

Remove __P() usage.

Remove 'register' keyword.

When multiple threads call atexit at the same time, some operations must
be serialized. A mutex is used to protect the critical regions.

sbrk() and brk() are not thread safe. Replace use of sbrk() with
a call to malloc to avoid race when one thread calls atexit
while another thread calls malloc.

Reviewed by: deischen

Add ifdefs for sparc64.

Minor typo fix: uquad_t -> u_quad_t.

mdoc(7) police: add missing markup bits for ``errno''.

Back out errno preserving

Add "except the handling of errors" into "equivalent to" paragraph.

Pointed by: bde
Inspired by: POSIX

Preserve errno.

According to C99:
"The functions atof, atoi, atol, and atoll need not
affect the value of the integer expression errno on an
error. If the value of the result cannot be represented,
the behavior is undefined."

* cleanup comments and defines

Reviewed by: bde

mdoc(7) police: fix markup, bump document date.

mdoc(7) police: kill HSBs, add missing comma.

mdoc(7) police: fix markup.

Add my e-mail to copyrights

Get rid of unused anymore file! Alpha works fine with our strtod() now.

Return 'c' back to signed due to potential comparison problems
Use simpler test for valid ranges

Submitted by: bde

Use the merged strtod.c everywhere. This has been tested on alpha and
ia64.

Make it works for non ASCII compatible encodings too.
The only assumption left is that 'A'..'Z' 'a'..'z' both are contiguous

Merge NetBSD's changes from netbsd_strtod.c in preparation of
removing it from our source tree in order to have one version
of strtod() for all arches. netbsd_strtod.c still left in source
tree until alpha folks make sure that our native strtod() works
as well as NetBSD's one.

Reviewed by: peter, bde (some time ago)

Back out national digits support, POSIX explicetely disallows it:

The definition of character class digit requires that only ten characters
-the ones defining digits- can be specified; alternate digits (for
example, Hindi or Kanji) cannot be specified here. However, the encoding
may vary if an implementation supports more than one encoding.

The definition of character class xdigit requires that the characters
included in character class digit are included here also and allows for
different symbols for the hexadecimal digits 10 through 15.

Don't ever assume that isdigit() is always subset of isxdigit()

Fix typo

Use stricter tests to disallow national digits > 9
Optimize national digits code a bit

Allow national (non-ASCII) digits

Implement strtoimax() and strtoumax()

Also mention "long long" in synopsis.

Base 36 is allowed.

Put back base > 35 check. If someone dislike it, plese discuss it with
standards group first.

Add atoll(3) to conform POSIX and C99

Understand national (non-ASCII) digits now
Allow bases >=36 again
Misc cleanup

Be more explicit about the fact that realloc() might return a
different pointer than the one passed to it.

PR: docs/31925
Submitted by: Andrew <andrew@ugh.net.au>

mdoc(7) police: fixed typos and minor markup nits.

If 'VX' is given, realloc(foo,0) will bail, it shouldn't.

PR: 29376
Submitted by: Farooq Mela <fmela0@sm.socccd.cc.ca.us>

Correctly call THREAD_UNLOCK() if the recursive call trap is sprung.

Pointed out by: knu

o Implement imaxabs(), imaxdiv(), llabs(), lldiv().
o Update abs(3), div(3), labs(3), ldiv(3) to reflect standards
conformance and add additional references.

Reviewed by: bde, wollman

malloc and calloc do not free memory.

PR: 31365
Submitted by: SUZUKI Koichi <koich@cac.co.jp>

Make strtod.c work on Alpha as well. strtod.c has got locale support,
the netbsd_strtod.c file we have does not. More still should be done
here, but this works happily on my Alpha. I have not (yet?) changed
the Makefile.inc to use this.

Slightly closer to netbsd_strtod.c:
s/IEEE_8087/IEEE_LITTLE_ENDIAN/
s/IEEE_MC68k/IEEE_BIG_ENDIAN/

phkmalloc->evilchecks++;

If zero bytes are allocated, return pointer to the middle of page-zero
(which is protected) so that the program will crash if it dereferences
this illgotten pointer.

Inspired & Urged by: Theo de Raadt <deraadt@cvs.openbsd.org>

Add a long-overdue nail to the deprecated /dev/urandom interface
by asking some things that need unpredictable numbers to read
/dev/random instead.

Make this work on ia64. I have no idea why it works on alpha - it
shouldn't.

Avoid getting stuck in system(3) when the internal call to wait4()
is interrupted by saving the pid.

The old code would assign the return value to pid which would trash
it, to fix the problem save a copy of the pid to be used as the
paramter to wait4().

Submitted by: Toshihiko ARAI <toshi@jp.FreeBSD.org>

mdoc(7) police: don't split author names in the AUTHORS section.

mdoc(7) police: s/atof/atoi/

Add ERRORS section.
Mention thread safety and async-cancel safety status [not].
Add standards compliancy references.
Note strtol() is preferred over atoi().

MFC after: 2 weeks

Be explicit about the POSIX version it conforms to [in this case 1990].
Put the error comment under the more appropriate ERRORS section.

Change standards compliancy order so that C and POSIX are grouped.

style(9)

Silence from: phantom

mdoc(7) police: changed pure POSIX text; added missing markup bits.

Add more standards which we conform to.
Note our implementation is not thread nor async-cancel safe.
Explicitely note atof() does not check nor report errors.
Note that strtod() should be used instead.

Detail thread-safe and async-cancel-safe status.
Also add C99 conformity status plus clarification that C99 leaves the
flushing of unwritten data, closure of open streams, and removal of
temporary files to the implementation.

Move to using .In instead of .Fd #include <> for include mark-up.

Inspired by comment from: dd

reconnect strfmon.c to build list

Fix some mdoc nits caused by my knowledge not being too up-to-date on
mdocNG.

Submitted by: dd

Port to ia64, taking into account the fact that pagesizes may be variable.

Add strfmon.3 to the fray.
This is a first cut, but enough to help people interested in using it
further than before.
More text coming to illustrate use and provide more details.

Based on standards' text.

correctly wrap macros with { }

strfmon(3) is not ready to go live.

Add strfmon(3) implementation. It still contains few XXX's because I lost
my last version of this work due to HDD crash, but this version cleanly
passed all POSIX and SuSv2 tests. I am working on testing scripts which
should test this implementation against all locales and surely more fixes
will come soon.

Reviewed by: ache, silence at -audit & -developers

Portability fix: use unsigned cast to guaranteed positive part of expression
in case {L}LONG_MAX > abs({L}LONG_MIN). Non-functional change - we don't
have any such platforms.

Remove rcsids and unneded include

'acc' is not initialized in one hypotetical case, fix it

Locale *is* used in strto*l*(), at least for isspace(), so remove
'locale not used' statement from comments and BUGS section of manpage.

strtol(): fix non-portable 'cutoff' calculation using the same method as
in strtoll().

Cleanup 'cutoff' calculation, remove unneded casts. Misc. cleanup to
make all functions looks the same.

Implement EINVAL reaction per POSIX, document it in manpage, corresponding
POSIX example quotes here:

------------------------------------------------
If the subject sequence is empty or does not have the expected form, no
conversion is performed; the value of str is stored in the object pointed
to by endptr, provided that endptr is not a null pointer.

If no conversion could be performed, 0 shall be returned and errno may be
set to [EINVAL].

[EINVAL] The value of base is not supported.

Since 0, {LONG_MIN} or {LLONG_MIN}, and {LONG_MAX} or {LLONG_MAX} are
returned on error and are also valid returns on success, an application
wishing to check for error situations should set errno to 0, then call
strtol( ) or strtoll ( ), then check errno.
-----------------------------------------------------

Use ``.Rv -std'' wherever possible.

Submitted by: yar

If the string specifying the allowed options starts with a leading `:',
`getopt(3)' should not print a warning for missing argument values.

PR: bin/29625
Reviewed by: mikeh
MFC after: 1 week

Fixed style bugs (dot `.' at the end of error and warning messages).

Noticed by: bde

Markup nits: use diagnostic type lists for error and warning messages.

Backout previous revision. We should not expand plain text xrefs if
they appear in the literal text, e.g. in the error or warning message
of the library function. (Submitted by: bde)

Moved "out of memory" from warning to errors section.

Use the ``.Rv -std'' mdoc(7) macro in appropriate cases.

Reviewed by: ru

mdoc(7) police: expand plain text xrefs.

Only pull in the MD files if they exist. This allows for progressive
implementation and compilation when bringing up a new architecture.

Remove whitespace at EOL.

mdoc(7) police: removed HISTORY info from the .Os call.

mdoc(7) police: eliminate -ww warnings.

mdoc(7) police: remove extraneous .Pp before and/or after .Sh.

mdoc(7) police: mark NULL with .Dv.

mdoc(7) police: the BUGS section should go after HISTORY and AUTHORS.

The fact that phk wrote this is not a bug!

Reword a sentence to make it proper English.

urandom(4) -> random(4) in comments.

PR: 27858
Submitted by: Yoshihiro Koya <Yoshihiro.Koya@math.yokohama-cu.ac.jp>
Reviewed by: md5(1)
Approved by: markm

urandom(4) -> random(4)

PR: 27858
Submitted by: Yoshihiro Koya <Yoshihiro.Koya@math.yokohama-cu.ac.jp>
Approved by: markm

Add new, from scratch implementation of hsearch() et al that actually works.

Obtained from: NetBSD
MFC after: 1 month

Grammar nit.

Add sranddev.3 to MLINKS

Add #include "un-namespace.h"

srand*dev() fallback code: change ^getpid() to ^(getpid() << 16) to allow
change of high word part too to produce more interesting seed distribution.

Add sranddev() since srand() is not vary much with seed, typical time

MAN[1-9] -> MAN.

Make tdelete(3), tfind(3), and twalk(3) links to tsearch(3).

Approved by: nik

Merge in strtoul.3 rev 1.11 mdoc(7) police changes:
.Nd line broken in rev 1.10
use .Bx for ``BSD''

mdoc(7) police: fix the .Nd line broken in previous revision.

Noticed by: bde

Use .Bx for ``BSD''.

Use formula with better random distribution for rand()

Even better formula from random() could not be intetgrated because rand_r()
supposed to store its state in the single variable (but table needed for
random() algorithm integration).

I accidently deleted an include when I added the $FreeBSD$ so I could
check in my changes.

Impliment the ISO-C99 strto[u]ll()
and rewrite strto[u]q() in terms of it.

.St -ansiC -> .St -isoC

Update unused __dtoa prototypes to match reality.

Remove freelists managed by Balloc/Bfree.
Change __dtoa to not free the string it allocated the previous time it was
called. The caller now frees the string after usage if appropiate.

PR: 15070
Reviewed by: deischen

"Cross references in the SEE ALSO section should be sorted by section
number, and then placed in alphabetical order and comma separated.",
mdoc.samples(7) said.

mmap(3) -> mmap(2).

Include mmap(2) in the list of memory allocation functions.

Reviewed by: hackers

.Xr to mmap.

mdoc(7) police: mark LC_NUMERIC with .Dv.

Note that decimal point taken from locale

Note the fact that decimal point taken from locale (according to SUSv2)

Use decimap_point from localeconv() instead of hardcoded '.'

Obtained from: inspired by NetBSD strtod

Backout previous commit. Use of spinlocks was not approved.
PR: 15070

Protect freelists managed by Balloc/Bfree with a spinlock.
Change __dtoa to not free the string it allocated the previous time it was
called. The caller now frees the string after usage if appropiate.

PR: 15070

mdoc(7) police: Change -filled displays (which just happen
to be the same as -ragged in the current implementation) to
-ragged. With mdocNG, -filled displays produce the correct
output, formatted and justified to both margins.

Fixed C error(s) in synopsis. Many were hiding under mdoc errors.

Remove a sizeof(void *) == sizeof(int) assumption.

Submitted by: Loren James Rittle <rittle@latour.rsch.comm.mot.com>

mdoc(7) police: split punctuation characters + misc fixes.

Remove _THREAD_SAFE and make libc thread-safe by default by
adding (weak definitions to) stubs for some of the pthread
functions. If the threads library is linked in, the real
pthread functions will pulled in.

Use the following convention for system calls wrapped by the
threads library:
__sys_foo - actual system call
_foo - weak definition to __sys_foo
foo - weak definition to __sys_foo

Change all libc uses of system calls wrapped by the threads
library from foo to _foo. In order to define the prototypes
for _foo(), we introduce namespace.h and un-namespace.h
(suggested by bde). All files that need to reference these
system calls, should include namespace.h before any standard
includes, then include un-namespace.h after the standard
includes and before any local includes. <db.h> is an exception
and shouldn't be included in between namespace.h and
un-namespace.h namespace.h will define foo to _foo, and
un-namespace.h will undefine foo.

Try to eliminate some of the recursive calls to MT-safe
functions in libc/stdio in preparation for adding a mutex
to FILE. We have recursive mutexes, but would like to avoid
using them if possible.

Remove uneeded includes of <errno.h> from a few files.

Add $FreeBSD$ to a few files in order to pass commitprep.

Approved by: -arch

Prepare for mdoc(7)NG.

mdoc(7) police: Ft/Vt now accept punctuation-type arguments.

Fixed typo not fixed in previous revision.

Prepare for mdoc(7)NG.

mdoc(7) police: removed history info from the .Os FreeBSD call.

Add `_PATH_DEVZERO'.
Use _PATH_* where where possible.

The parameter that contains valid options is "optstring", not "optarg".

Make it possible to override the function which writes messages to
stderr in case of warnings and errors.

Rename malloc_options to have a leading underscore, I belive I have been
told that is more correct namespace wise.

mdoc(7) police: Er macro usage cleanup.

mdoc(7) police: use certified section headers wherever possible.

Use Fx macro wherever possible.

Fixed typos.

Back out previous commit (MLINK malloc.conf.5 -> malloc.3).
This did not work correctly with whatis(1).

Issue brought up by: mpp

Add link malloc.conf.5 -> malloc.3

Oops, un-spam this file - the last commit was an accident.

Pointed out by: phk

Only realloc() environ if we're sure that we know where it came from.

The recent problems with sshd were due to sshd reassigning
`environ' when setenv() thinks it owns it. setenv() subsequently
realloc()s the new version of environ and *boom*

Don't print an error message if the bad option is '?'. This has been
in my tree for a long time. bde reviewed this once upon a time and
said it was OK, iirc. This also obviates the need to put ? in the
optstring argument to preclude the extra warning message which some
people think confuses users. When I made my getopt cleanups of a long
time ago, this was the compromise reached. I just neglected to commit
it until now.

Turn malloc options "AJ" on by default.

These will be turned off again as we approach 5.0-RELEASE.

If you benchmark things, make sure to
ln -sf j /etc/malloc.conf
to see "true" performance.

bring in binary search tree code.

Obtained from: NetBSD

Fix miscellaneous mdoc macro argument limit infringements.

PR: 18465
Reported by: Kazu TAKAMUNE <takamune@avrl.mei.co.jp>