Remove svn:mergeinfo carried over from stable/9.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC r266285,266866:

------------------------------------------------------------------------
r266285 | bjk | 2014-05-16 23:05:52 -0400 (Fri, 16 May 2014) | 9 lines

Correct documentation of the limit on how much memory can be mlock()ed

vm.max_wired is a system-wide limit, not per-process. Reword the
section to make this more clear.

PR: docs/189214
Submitted by: Lawrence Chen (original text)
Approved by: hrs (mentor)

------------------------------------------------------------------------
r266866 | bjk | 2014-05-29 22:16:28 -0400 (Thu, 29 May 2014) | 5 lines

Minor mdoc fix

Submitted by: hrs
Approved by: hrs (mentor, implicit)

------------------------------------------------------------------------

PR: 189214
Approved by: re (gjb), hrs (mentor)

MFC r265534:

msync(2) must return ENOMEM and not EINVAL when the address is outside the
allowed range or when one or more pages are not mapped. This according to
The Open Group Base Specifications Issue 7.

Sponsored by: EMC / Isilon storage division

MFC: r262296

Match the correct variable to the variable description.

PR: 121173
Submitted by: Thomas Mueller <tmueller at sysgo.com>

MFC: r261447

Fix a typo.

MFC r261080:
The posix_fallocate(2) syscall should return error number on error,
without modifying errno.

MFC r261290:
The posix_madvise(3) and posix_fadvise(2) should return error on
failure, same as posix_fallocate(2).

MFC r261075: Update EINVAL description.

MFC r259921,259950:

Provide the manual page for aio_fsync(2).

MFC 255708,255711,255731:
Extend the support for exempting processes from being killed when swap is
exhausted.
- Add a new protect(1) command that can be used to set or revoke protection
from arbitrary processes. Similar to ktrace it can apply a change to all
existing descendants of a process as well as future descendants.
- Add a new procctl(2) system call that provides a generic interface for
control operations on processes (as opposed to the debugger-specific
operations provided by ptrace(2)). procctl(2) uses a combination of
idtype_t and an id to identify the set of processes on which to operate
similar to wait6().
- Add a PROC_SPROTECT control operation to manage the protection status
of a set of processes. MADV_PROTECT still works for backwards
compatability.
- Add a p_flag2 to struct proc (and a corresponding ki_flag2 to kinfo_proc)
the first bit of which is used to track if P_PROTECT should be inherited
by new child processes.

MFC r259872:

The compile time constant limit on number of swap devices was removed in 5.2.
As such, remove the EINVAL error saying so. Currently the vm.nswapdev sysctl
just represents the number of added swap devices.

MFC 253471,253620,254430,254538:
Change mmap() to more optimally use superpages and provide support for
tweaking alignment of virtual mappings.
- Add a new address space allocation method (VMFS_OPTIMAL_SPACE) for
vm_map_find() that will try to alter the alignment of a mapping to match
any existing superpage mappings of the object being mapped. If no
suitable address range is found with the necessary alignment,
vm_map_find() will fall back to using the simple first-fit strategy
(VMFS_ANY_SPACE).
- Change mmap() without MAP_FIXED, shmat(), shm_map(), and the GEM mapping
ioctl to use VMFS_OPTIMAL_SPACE instead of VMFS_ANY_SPACE.
- MAP_ALIGNED(n) requests a mapping aligned on a boundary of (1 << n).
Requests for n >= number of bits in a pointer or less than the size of
a page fail with EINVAL. This matches the API provided by NetBSD.
- MAP_ALIGNED_SUPER is a special case of MAP_ALIGNED. It can be used
to optimize the chances of using large pages. By default it will align
the mapping on a large page boundary (the system is free to choose any
large page size to align to that seems best for the mapping request).
However, if the object being mapped is already using large pages, then
it will align the virtual mapping to match the existing large pages in
the object instead.
- Internally, VMFS_ALIGNED_SPACE is now renamed to VMFS_SUPER_SPACE, and
VMFS_ALIGNED_SPACE(n) is repurposed for specifying a specific alignment.
MAP_ALIGNED(n) maps to using VMFS_ALIGNED_SPACE(n), while
MAP_ALIGNED_SUPER maps to VMFS_SUPER_SPACE.
- mmap() of a device object now uses VMFS_OPTIMAL_SPACE rather than
explicitly using VMFS_SUPER_SPACE. All device objects are forced to
use a specific color on creation, so VMFS_OPTIMAL_SPACE is effectively
equivalent.

PR: ports/184173 (exp-run)

MFC r257874:

Fix extattr(2) MLINKS.

MFC 253656: Enhance the description of NOTE_TRACK:
- NOTE_TRACK has never triggered a NOTE_TRACK event from the parent pid.
If NOTE_FORK is set, the listener will get a NOTE_FORK event from
the parent pid, but not a separate NOTE_TRACK event.
- Explicitly note that the event added to monitor the child process
preserves the fflags from the original event.
- Move the description of NOTE_TRACKERR under NOTE_TRACK as it is not a
bit for the user to set (which is what this list pupports to be).
Also, explicitly note that if an error occurs, the NOTE_CHILD event
will not be generated.

MFC r239347, 240295, 240296 and 253325:

r239347 | davidxu | 2012-08-17 10:26:31 +0800 (Fri, 17 Aug 2012) | 7 lines

Implement syscall clock_getcpuclockid2, so we can get a clock id
for process, thread or others we want to support.
Use the syscall to implement POSIX API clock_getcpuclock and
pthread_getcpuclockid.

PR: 168417

------------------------------------------------------------------------
r240295 | davidxu | 2012-09-10 13:00:29 +0800 (Mon, 10 Sep 2012) | 2 lines

Add missing prototype for clock_getcpuclockid.

------------------------------------------------------------------------
r240296 | davidxu | 2012-09-10 13:09:39 +0800 (Mon, 10 Sep 2012) | 2 lines

Process CPU-Time Clocks option is supported, define _POSIX_CPUTIME.

------------------------------------------------------------------------
r253325 | kib | 2013-07-14 03:32:50 +0800 (Sun, 14 Jul 2013) | 6 lines

Allow to call clock_gettime() on the clock id for zombie process.

Reported by: Petr Salinger <Petr.Salinger@seznam.cz>
PR: threads/180496
Sponsored by: The FreeBSD Foundation

MFC r251181: fork(2): #include <sys/types.h> is not needed.

MFC r248774: accept(2): Mention inheritance of O_ASYNC and signal
destination.

While almost nobody uses O_ASYNC, and rightly so, the inheritance of the
related properties across accept() is a portability issue like the
inheritance of O_NONBLOCK.

MFC r250982: sigreturn(2): Remove ancient compatibility warning about 4.2BSD

The HISTORY subsection still says that sigreturn() was added in 4.3BSD.

Merge r248489:
There are actually two different cases when mlock(2) returns
ENOMEM. Clarify this, taking text from SUS.

Reviewed by: kib

MFC r248593: Allow O_CLOEXEC in posix_openpt() flags.

PR: kern/162374

dup(2): Remove incorrect sentence about getdtablesize().

There are no getdtablesize() bounds on the file descriptor to be duplicated;
it only has to be open. If the RLIMIT_NOFILE rlimit was decreased after
opening the file descriptor, it may be greater than or equal to
getdtablesize() but still valid.

MFC r249859: getdtablesize(2): Describe what this function actually does.

getdtablesize() returns the limit on new file descriptors; this says nothing
about existing descriptors.

MFC r249979: intro(2): Fix some errors in ENFILE and EMFILE descriptions.

MFC r246617: sigqueue(2): Fix typo (EEPERM -> EPERM).

MFC r238802:
Update the 'C1x draft' reference to '.St -isoC-2011' mdoc macro.

MFC r246485:
Document the detail of interaction between vfork and PT_TRACEME.

MFC r246476:
Document the ERESTART translation to EINTR for devfs nodes.

MFC r246117:
Rework the __vdso_* symbols attributes to only make the symbols weak,
but use normal references instead of weak. This makes the statically
linked binaries to use fast gettimeofday(2) by forcing the linker to
resolve references and providing the neccessary functions.

Merge r245841:
posix_fadvise(2) first appeared in FreeBSD 9.1

MFC r245458:
- Use standard RETURN VALUES section.

MFC r244679:
- Update manual pages accordingly to r244384 and r244385.

Approved by: kib (mentor)

MFC r242961:
Document wait6() and waitid().

PR: standards/170346

MFC r242960:
Implement the waitid() SUSv4 function using wait6() system call.

PR: standards/170346

MFC r242429: fcntl(2): Fix typos in name of constant "F_DUP2FD_CLOEXEC".

MFC r241855:
Update the kill(2) and killpg(2) man pages to the modern permission
checks. Also indicate killpg(2) is POSIX compliant.

Approved by: cperciva (implicit)

Merge r240385 from head:
Describe in detail required conditions for receiving the SCM_CREDS
control message and suggest to use LOCAL_CREDS setsockopt() for
reliability.

MFC 240132:
When WIFCONTINUED was added, the number of "first" macros grew from
three to four.

MFC r241001: sigaction(2),sigwait(2),sigwaitinfo(2): Remove [EFAULT] error
condition.

Passing an invalid pointer results in undefined behaviour.

The wrappers in libthr access some of the data pointed to by the arguments
in userland, so that an invalid pointer will cause a signal and not an
[EFAULT] error return.

Furthermore, if the [EFAULT] error occurs when the kernel is writing, it is
not a proper error in the sense that the call still commits (changing the
signal disposition or accepting the signal).

MFC r237434:
Use struct vdso_timehands data to implement fast gettimeofday(2) and
clock_gettime(2) functions if supported.

MFC r238667:
Fixes for symbols visibility issues and style in fcntl.h.

MFC r238835:
Document F_DUP2FD_CLOEXEC.

MFC r238615:
Document F_DUPFD_CLOEXEC.

MFC 230782,237274:
Refine the implementation of POSIX_FADV_NOREUSE to perform
POSIX_FADV_DONTNEED requests on the currently accessed portion of the
file on each read(2) or write(2) rather than using direct I/O. This
gives much better performance including read-ahead and write clustering
similar to normal read(2) and write(2) calls.

If subsequent read(2) and write(2) calls are sequential, then the
POSIX_FADV_DONTNEED requests will cover the entire sequentially-accessed
range.

MFC: r231616, r232497, r234337

Add __aeabi_read_tp function required for thread-local storage.

MFC: r233106, r233107

Fix TLS for statically linked binaries.

MFC: r232582 (partial)

- Switch ARM to TLS Variant I.
- Fix TLS allocation for Variant I: both rtld and libc allocators
assume that tls_static_space includes space for TLS structure.
So increment calculated static size by the size of it.

MFC r233648:
Remove trailing whitespace per mdoc lint warning

Approved by: cperciva (implicit)

MFC r236042:
Clarify the SEEK_HOLE description, it repositions the file pointer.

MFC r234712, r234744, r234934, r234988, r235294, r235335,
and bits of r235337 and r235355:

A new jail(8) with a configuration file, ultimately to replace the work
currently done by /etc/rc.d/jail.

MFC r235140:

General mdoc(7) and typo fixes.

PR: 167713

MFC r234820:
pread(2) might fail with EBUSY, so document it

PR: docs/167201
Approved by: cperciva (implicit)

MFC r234131:
Return EBADF instead of EMFILE from dup2 when the second argument is
outside the range of valid file descriptors

PR: kern/164970
Approved by: cperciva (implicit)

MFC r232157, r232158:

r232157:
Fix various typos in manual pages.

Submitted by: amdmi3
PR: 165431

r232158:
Whitespace cleanup:
o Wrap sentences on to new lines
o Cleanup trailing whitespace

MFC r233160:
Expound a bit more about the system maximum number of FIBs,
how it may be set, and current limitations on the value.

PR: docs/157453
Approved by: hrs (mentor)

MFC r233002, r233003 and r233012:

Remove impossible error condition from the man page.

On FreeBSD, all processes have a process group, so it is impossible for
kill(2) to fail this way. POSIX also doesn't mention this error
condition.

MFC r233102:
Do not claim that msync(2) is obsoleted.
Document EIO from msync(2).

MFC r230155:
Make man page wording more clear

PR: docs/164078
Approved by: cperciva (implicit)

MFC r232180:
Document SO_PROTOCOL socket option.

MFC 230857:

If multiple threads call kevent() to get AIO events on same kqueue fd,
it is possible that a single AIO event will be reported to multiple
threads, it is not threading friendly, and the existing API can not
control this behavior.
Allocate a kevent flags field sigev_notify_kevent_flags for AIO event
notification in sigevent, and allow user to pass EV_CLEAR, EV_DISPATCH
or EV_ONESHOT to AIO kernel code, user can control whether the event
should be cleared once it is retrieved by a thread. This change should
be comptaible with existing application, because the field should have
already been zero-filled, and no additional action will be taken by
kernel.

PR: kern/156567

MFC 231006:

Add 32-bit compat code for AIO kevent flags introduced in revision 230857.

MFC 231724:

Add notes about sigev_notify_kevent_flags introduced in revision 230857
which enables thread-friendly polling on same fd for AIO events.

Reviewed by: delphij

MFC 231777:

Bump .Dd date for previous revision.

MFC r231902:
Document PL_FLAG_CHILD.

MFC r231236: Acknowledge that jail_attach and jail_remove can return EPERM.

MFC 231196:
eui64_aton and eui64_ntoa are actually the equivalent of ether_aton_r and
ether_nota_r and do not use static variables so remove the note copied
from ethers.3 saying they do.

Reported by: bms

MFH r226166: Document some not-so-recently added trace points

Approved by: des (mentor)

MFC r230613:
Remove a left-over reference to make.conf(5) for now-defunct -DVM_STACK

MFC r230460:
Clarify the implementation-defined behaviour in case of close(2)
returning error.

MFC 227070,227341,227502:
Add the posix_fadvise(2) system call. It is somewhat similar to
madvise(2) except that it operates on a file descriptor instead of a
memory region. It is currently only supported on regular files.

Note that this adds a new VOP, so all filesystem modules must be
recompiled.

Approved by: re (kib)

MFC r228970:

Fix manual section for acl_get(3) and mac_get(3) family functions.

MFC r227792:

Add history for setsockopt(2).

PR: docs/162719
Submitted by: Niclas Zeising <niclas at zeising gmail>

MFC r225974:
Remove no longer valid statement about ARM.

MFC r226066:
Remove no longer needed BUGS section.

MFC r227622:
Fix typo.

Merge r228040 from head to stable/9:

Cross-reference capsicum.4 from cap_enter.2 and cap_new.2.

Sponsored by: Google, Inc.

Approved by: re (kib)

MFC r227416:

Document that flock can return ENOLCK

Approved by: re (kib)

MFC r226790:
Fix typo in timer_getoverrun cross-reference.

Approved by: re (kib)

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Clarify the behaviour of sigwait() on signal interruption, and note
the difference between sigwait() and sigtimedwait()/sigwaitinfo().

Approved by: re (bz)

Add experimental support for process descriptors

A "process descriptor" file descriptor is used to manage processes
without using the PID namespace. This is required for Capsicum's
Capability Mode, where the PID namespace is unavailable.

New system calls pdfork(2) and pdkill(2) offer the functional equivalents
of fork(2) and kill(2). pdgetpid(2) allows querying the PID of the remote
process for debugging purposes. The currently-unimplemented pdwait(2) will,
in the future, allow querying rusage/exit status. In the interim, poll(2)
may be used to check (and wait for) process termination.

When a process is referenced by a process descriptor, it does not issue
SIGCHLD to the parent, making it suitable for use in libraries---a common
scenario when using library compartmentalisation from within large
applications (such as web browsers). Some observers may note a similarity
to Mach task ports; process descriptors provide a subset of this behaviour,
but in a UNIX style.

This feature is enabled by "options PROCDESC", but as with several other
Capsicum kernel features, is not enabled by default in GENERIC 9.0.

Reviewed by: jhb, kib
Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc

Cross-reference cap_new(2) from dup(2), as they have similar functionality.

Approved by: re (kib)

Add cap_new(2) and cap_getrights(2) symbols to libc.

These system calls have already been implemented in the kernel; now we
hook up libc symbols so userspace can drive them.

Approved by: re (kib), mentor (rwatson)
Sponsored by: Google Inc

Document RFTSIGZMB. Fix spelling of SIGCHLD. Note that signals are
delivered, not returned.

MFC after: 1 week

Note how wait(3) is implemented.

mq_setattr(2): Add missing const to man page.

The declaration in the header file is correct.

MFC after: 1 week

Update sticky(7) cross references.

PR: docs/124468
X-MFC with: r218998

- Clarification on kld_file_stat.size
- While here, remove a few C comments that don't seem to contribute
anything additional to the man page.

PR: 146047
Submitted by: arundel
MFC after: 3 days

Add the posix_fallocate(2) syscall. The default implementation in
vop_stdallocate() is filesystem agnostic and will run as slow as a
read/write loop in userspace; however, it serves to correctly
implement the functionality for filesystems that do not implement a
VOP_ALLOCATE.

Note that __FreeBSD_version was already bumped today to 900036 for any
ports which would like to use this function.

Also reserve space in the syscall table for posix_fadvise(2).

Reviewed by: -arch (previous version)

getfh(2): Add xrefs for fhopen(2), open(2), stat(2).

MFC after: 1 week

Fix mdoc errors.

Submitted by: ru
MFC after: 3 days

Expose the rctl(2) API in libc.

Document O_CLOEXEC.

Reviewed by: jhb
MFC after: 1 week

When building libc with the syscall compatibility, don't also generate the
syscall assembly files. This results in conflicting dependencies and can
cause unexpected results for parallel builds. This is because the .c file
and the .S file both generate the same .o file.

Submitted by: Simon Gerraty <sjg@juniper.net>
Sponsored by: Juniper Networks

rfork(2): Discourage rfork_thread-like approaches.

Calling rfork_thread(3) does not interoperate with pthreads and global state
is not properly protected.

Remove the BUGS section suggesting LinuxThreads entirely. With the current
pthread library libthr, all threads are kernel-level entities so there seems
little reason to use LinuxThreads.

Move cap_enter(2) and cap_getmode(2) symbols from FBSD_1.1 to FBSD_1.2.

Suggested by: kib
Obtained from: Capsicum Project
Sponsored by: Google
MFC after: 3 months

Move getloginclass(2) and setloginclass(2) to FBSD_1.2, where they should've
been added in the first place.

Add FBSD_1.2; syscalls added in 9-CURRENT are supposed to go there.

Suggested by: kib

Add manual page for getloginclass(2) and setloginclass(2).

Add two new system calls, setloginclass(2) and getloginclass(2). This makes
it possible for the kernel to track login class the process is assigned to,
which is required for RCTL. This change also make setusercontext(3) call
setloginclass(2) and makes it possible to retrieve current login class using
id(1).

Reviewed by: kib (as part of a larger patch)

Make cap_new(2) and cap_getmode(2) symbols from libc public so applications
can link against them. Add man pages for the new system calls, with one
errant forward reference to changes not yet present in FreeBSD, but soon
will be.

Reviewed by: anderson
Obtained from: Capsicum Project
Sponsored by: Google, Inc.
Discussed with: benl, kris, pjd
MFC after: 3 months

Add description of ECAPMODE to errno(2) man page.

Discussed with: anderson
Obtained from: Capsicum Project
Sponsored by: Google, Inc.
MFC after: 3 months

Remove sysctl vm.max_proc_mmap used to protect from KVA space exhaustion.
As it was pointed out by Alan Cox, that no longer serves its purpose with
the modern UMA allocator compared to the old one used in 4.x days.

The removal of sysctl eliminates max_proc_mmap type overflow leading to
the broken mmap(2) seen with large amount of physical memory on arches
with factually unbound KVA space (such as amd64). It was found that
slightly less than 256GB of physmem was enough to trigger the overflow.

Reviewed by: alc, kib
Approved by: avg (mentor)
MFC after: 2 months

Emit .note.GNU-stack for the syscall stubs generated by libc only on
architectures that support this .note. In particular, do not unneccessary
emit the notes on ia64 and sparc64, which ABI require non-executable stacks.

Tested by: marcel

Document PT_FLAG_FORKED, PT_FOLLOW_FORK, pl_tdname and pl_child_pid.

MFC after: 2 weeks

getgroups(2): Remove mention of <sys/param.h> and refer to sysconf(3).

Because {NGROUPS_MAX} may become variable, its value should be obtained
using sysconf(3). If a #define is used anyway, it should be obtained by
including <limits.h> as that is in POSIX like getgroups(2) itself is.
<sys/param.h> is not in POSIX.

MFC after: 1 week

mknod(2): The required include is <sys/stat.h>, not <unistd.h>.

This is what SUSv4 requires, and also the only thing that works if strict
standards compliance is requested or mknodat() is needed.

PR: standards/123688
Submitted by: gcooper
MFC after: 1 week

Emit .note.GNU-stack for the syscall stubs generated by libc.

Sort cross references by section.

Reported by: pluknet

Update shmget(2) with POSIX access permissions and remove non-standard SHM_R,
SHM_W and machine/param.h.

This commit implements the SO_USER_COOKIE socket option, which lets
you tag a socket with an uint32_t value. The cookie can then be
used by the kernel for various purposes, e.g. setting the skipto
rule or pipe number in ipfw (this is the reason SO_USER_COOKIE has
been implemented; however there is nothing ipfw-specific in its
implementation).

The ipfw-related code that uses the optopn will be committed separately.

This change adds a field to 'struct socket', but the struct is not
part of any driver or userland-visible ABI so the change should be
harmless.

See the discussion at
http://lists.freebsd.org/pipermail/freebsd-ipfw/2009-October/004001.html

Idea and code from Paul Joe, small modifications and manpage
changes by myself.

Submitted by: Paul Joe
MFC after: 1 week

- Note that non-superusers are not allowed to set the SF_ARCHIVED
flag. [1]
- Note that also fchflags(2) will return EPERM for attempts to set or
unset the SF_SNAPSHOT flag.

Submitted by: Garrett Cooper [1]
MFC after: 1 week

mdoc: make pages render with mandoc

It's a bit more pedantic regarding .Bl list elements. This has an added
benefit of unbreaking the ipfw(8) manpage, where groff was silently
skipping one list element.

Clang related fixes:
* When calling syslog(), pass a format string.
* Define YY_NO_INPUT on nslexer.l

Submitted by: Norberto Lopes <nlopes.ml at gmail.com>

mdoc: drop redundant .Pp and .LP calls

They have no effect when coming in pairs, or before .Bl/.Bd

Fix exec_imgact_shell()'s handling of two error cases: (1) Previously, if
the first line of a script exceeded MAXSHELLCMDLEN characters, then
exec_imgact_shell() silently truncated the line and passed on the truncated
interpreter name or argument. Now, exec_imgact_shell() will fail and return
ENOEXEC, which is the commonly used errno among Unix variants for this type
of error. (2) Previously, exec_imgact_shell()'s check on the length of the
interpreter's name was ineffective. In other words, exec_imgact_shell()
could not possibly fail and return ENAMETOOLONG. The reason being that the
length of the interpreter name had to exceed MAXSHELLCMDLEN characters in
order that ENAMETOOLONG be returned. But, the search for the end of the
interpreter name stops after at most MAXSHELLCMDLEN - 2 characters are
scanned. (In the end, this particular error is eventually discovered
outside of exec_imgact_shell() and ENAMETOOLONG is returned. So, the real
effect of this second change is that the error is detected earlier, in
exec_imgact_shell().)

Update the definition of MAXINTERP to the actual limit on the size of
the interpreter name that has been in effect since r142453 (from
2005).

In collaboration with: kib

Bump dates in dbopen(3) and cpuset_getaffinity(2) from r212441 and
r212438, repectively.

Approved by: keramida (mentor)
MFC after: 1 week

Add EINVAL to list of possible return values for cpuset_getaffinity(2).

PR: 149978
Submitted by: gcooper
Patch by: gcooper
Approved by: keramida (mentor)
MFC after: 1 week

Because POSIX does not allow EINTR to be returned from sigwait(),
add a wrapper for it in libc and rework the code in libthr, the
system call still can return EINTR, we keep this feature.

Discussed on: thread
Reviewed by: jilles

Add ECONNRESET to list of possible errors in connect(2).

PR: 148683
Submitted by: Gennady Proskurin <gpr at mail dot ru>
Approved by: keramida (mentor)
MFC after: 1 week

Use NULL instead of 0 for pointer in example.

MFC after: 3 days

Add the MAP_PREFAULT_READ option to mmap(2).

Reviewed by: jhb, kib

Fix incorrect usage of 'assure' and 'insure'.

Approved by: rrs (mentor)

Powerpc is special here. powerpc and powerpc64 use different ABIs, so
their implementations aren't in the same files. Introduce LIBC_ARCH
and use that in preference to MACHINE_CPUARCH. Tested by amd64 and
powerpc64 builds (thanks nathanw@)

Remove extra FreeBSD tag.

MFC after: 3 days

Move the __stack_chk_fail_local@FBSD_1.0 compat symbol definition into
the separate .o for libc_pic.a. This prevents rtld from making the
symbol global.

Putting the stack_protector_compat.c into the public domain acknowledged
by kan.

Reviewed by: kan
MFC after: 2 weeks

MFtbemd:

Prefer MACHNE_CPUARCH to MACHINE_ARCH in most contexts where you want
to test of all the CPUs of a given family conform.

Use aux vector to get values for SSP canary, pagesize, pagesizes array,
number of host CPUs and osreldate.

This eliminates the last sysctl(2) calls from the dynamically linked image
startup.

No objections from: kan
Tested by: marius (sparc64)
MFC after: 1 month

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Fix typos and spelling mistakes.

Spelling fixes.

Fix a couple of typos.

PR: docs/148891
Submitted by: olgeni
MFC after: 1 week

Update mlockall(2) to mention that it's superuser-only syscall, just
like the mlock(2) manual page says. Update mlock(2) to say that hitting
RLIMIT_MEMLOCK results in ENOMEM, not EAGAIN.

MFC after: 1 month

Document pl_siginfo and PT_FLAG_SI for PT_LWPINFO.

MFC after: 1 month

Just like in case of setgroups(2), for getgroups(2) also advice including
sys/param.h instead of sys/types.h so we get NGROUPS_MAX and NGROUPS
definitions.

mdoc: remove literal tabs where they don't belong

Change the current working directory to be inside the jail created by
the jail(8) command. [10:04]

Fix a one-NUL-byte buffer overflow in libopie. [10:05]

Correctly sanity-check a buffer length in nfs mount. [10:06]

Approved by: so (cperciva)
Approved by: re (kensmith)
Security: FreeBSD-SA-10:04.jail
Security: FreeBSD-SA-10:05.opie
Security: FreeBSD-SA-10:06.nfsclient

Improve the documentation for PT_LWPINFO. Note that some features are
not implemented on MIPS and ARM.

MFC after: 1 month

mdoc: move CAVEATS, BUGS and SECURITY CONSIDERATIONS sections to the
bottom of the manpages and order them consistently.

GNU groff doesn't care about the ordering, and doesn't even mention
CAVEATS and SECURITY CONSIDERATIONS as common sections and where to put
them.

Found by: mdocml lint run
Reviewed by: ru

Document FIONREAD, FIONWRITE and FIONSPACE.

Obtained from: NetBSD
Submitted by: emaste
MFC after: 1 week

sigprocmask(2): pthread_sigmask(3) must be used in threaded processes.
Although libthr's pthread_sigmask() just calls sigprocmask() and this is
unlikely to change, mention this POSIX requirement on applications.

MFC after: 1 week

Merger of the quota64 project into head.

This joint work of Dag-Erling Smørgrav and myself updates the
FFS quota system to support both traditional 32-bit and new 64-bit
quotas (for those of you who want to put 2+Tb quotas on your users).

By default quotas are not compiled into the kernel. To include them
in your kernel configuration you need to specify:

options QUOTA # Enable FFS quotas

If you are already running with the current 32-bit quotas, they
should continue to work just as they have in the past. If you
wish to convert to using 64-bit quotas, use `quotacheck -c 64';
if you wish to revert from 64-bit quotas back to 32-bit quotas,
use `quotacheck -c 32'.

There is a new library of functions to simplify the use of the
quota system, do `man quotafile' for details. If your application
is currently using the quotactl(2), it is highly recommended that
you convert your application to use the quotafile interface.
Note that existing binaries will continue to work.

Special thanks to John Kozubik of rsync.net for getting me
interested in pursuing 64-bit quota support and for funding
part of my development time on this project.

Update xrefs from 4.3BSD to modern signal functions in various man pages.

sigvec(2) references have been updated to sigaction(2), sigsetmask(2) and
sigblock(2) to sigprocmask(2), sigpause(2) to sigsuspend(2).

Some legacy man pages still refer to them, that is OK.

sigaltstack(2): document some modernizations:
* un-document 'struct sigaltstack' tag for stack_t as this is BSD-specific;
this doesn't seem useful enough to document as such
* alternate stacks are per thread, not per process
* update error codes to what the kernel does and POSIX requires

MFC after: 1 week

Document RUSAGE_THREAD.

Reviewed by: bde
MFC after: 1 week

unlinkat(2): unlinkat(AT_REMOVEDIR) fails with ENOTEMPTY like rmdir()
for non-empty directories.

POSIX permits both ENOTEMPTY and EEXIST, but we use the clearer ENOTEMPTY,
following BSD tradition.

MFC after: 1 week

Revert r206649.

Simplify the presented declaration of struct sigaction, noting the
caveat in the text. Real layout of the structure and exposed
implementation namespace only obfuscates the usage.

Submitted by: bde
MFC after: 3 days

Still reference struct __sigaction with clarification when this form
of argument declaration is needed.

Discussed with: bde
MFC after: 3 days

Align the declaration for sa_sigaction with POSIX.

MFC after: 3 days

Don't forget to bump the date in the man page.

Rename st_*timespec fields to st_*tim for POSIX 2008 compliance.

A nice thing about POSIX 2008 is that it finally standardizes a way to
obtain file access/modification/change times in sub-second precision,
namely using struct timespec, which we already have for a very long
time. Unfortunately POSIX uses different names.

This commit adds compatibility macros, so existing code should still
build properly. Also change all source code in the kernel to work
without any of the compatibility macros. This makes it all a less
ambiguous.

I am also renaming st_birthtime to st_birthtim, even though it was a
local extension anyway. It seems Cygwin also has a st_birthtim.

Reject attempts to create a MAP_ANON mapping with a non-zero offset.

PR: kern/71258
Submitted by: Alexander Best
MFC after: 2 weeks

Actually make O_DIRECTORY work.

According to POSIX open() must return ENOTDIR when the path name does
not refer to a path name. Change vn_open() to respect this flag. This
also simplifies the Linuxolator a bit.

The NetBSD Foundation has granted permission to remove clause 3 and 4 from
their software.

Obtained from: NetBSD

Mention EISDIR as a possible errno.

o Add support for COMPAT_IA32.
o Incorporate review comments:
- Properly reference and lock the map
- Take into account that the VM map can change inbetween requests
- Add the fileid and fsid attributes

Credits: kib@
Reviewed by: kib@

Add PT_VM_TIMESTAMP and PT_VM_ENTRY so that the tracing process can
obtain the memory map of the traced process. PT_VM_TIMESTAMP can be
used to check if the memory map changed since the last time to avoid
iterating over all the VM entries unnecesarily.

MFC after: 1 month

You must include fcntl.h (in practice) to be able to do anything useful
with shm_open(2), as otherwise the O_ flags are undefined.

MFC after: 3 days

Add information about when nmount(2) was introduced.

The waitpid(2) function needs neither sys/time.h nor sys/resource.h.

Miscellaneous mdoc, spelling and inconsistency fixes.

PR: 142573, 142576 (mostly)
Submitted by: brucec
MFC after: 1 week

Add a set of manual pages for pthread[_attr]_[sg]etaffinity(3).

Reviewed by: davidxu
MFC after: 2 weeks

Further fix grammar.

Suggested by: alc
MFC after: 3 days

Fix a typo and bump date for the previous commit.

Give some information on SF_MNOWAIT flag.

MFC after: 3 days

The devices that supported EVFILT_NETDEV kqueue filters were removed in
r195175. Remove all definitions, documentation, and usage.

fifo_misc.c:
Remove all kqueue tests as fifo_io.c performs all those that
would have remained.

Reviewed by: rwatson
MFC after: 3 weeks
X-MFC note: don't change vlan_link_state() function signature

Document _FAST and _PRECISE clocks.

Submitted by: Valentin Nechayev <netch segfault kiev ua>
MFC after: 3 days

Document CLOCK_SECOND, add cross-reference from time(3) to clock_gettime(2).

Based on submission by: pluknet gmail com
MFC after: 3 days

cpuset(2): fix a typo and a markup error in the man page

MFC after: 1 week

Fix many "function declaration isn't a prototype" warnings in libc.

I've only fixed code that seems to be written by `us'. There are still
many warnings like this present in resolv/, rpc/, stdtime/ and yp/.

Describe what setpgid(2) does when pgid=0. The text has been
copied from NetBSD's manpage, and it also matches the behavior
described by the Open Group's online copy of setpgid.2 at
http://www.opengroup.org/onlinepubs/009695399/functions/setpgid.html

Obtained from: NetBSD
Submitted by: Petros Barbayiannis <petrosbarbayiannis@yahoo.gr>
MFC after: 1 week

Remove a note about vfork(4) going to be eliminated, it's here to stay.

Submitted by: kib
MFC after: 1 week

Improved the manpage description. The committed wording
was provided by jhb.

PR: 140528
Submitted by: Chris Petrik <chris@officialunix.com>
Discussed with: remko, jhb and the submitter
MFC after: 1 week

Add MAP_ANONYMOUS.

Many operating systems also provide MAP_ANONYMOUS. It's not hard to
support this ourselves, we'd better add it to make it more likely for
applications to work out of the box.

Reviewed by: alc (mman.h)

Attempt to reduce accidental foot-shooting by pointing out that
accept(2)ed sockets do not necessarily inherit O_NONBLOCK from
listening sockets on non-FreeBSD platforms.

Feet shot: cperciva
MFC after: 1 month

Move pselect(3) man page to section 2.

Noted by: jhb
MFC after: 1 month

Current pselect(3) is implemented in usermode and thus vulnerable to
well-known race condition, which elimination was the reason for the
function appearance in first place. If sigmask supplied as argument to
pselect() enables a signal, the signal might be delivered before thread
called select(2), causing lost wakeup. Reimplement pselect() in kernel,
making change of sigmask and sleep atomic.

Since signal shall be delivered to the usermode, but sigmask restored,
set TDP_OLDMASK and save old mask in td_oldsigmask. The TDP_OLDMASK
should be cleared by ast() in case signal was not gelivered during
syscall execution.

Reviewed by: davidxu
Tested by: pho
MFC after: 1 month

Make openat(2) a cancellation point.

This is required by POSIX and matches open(2).

Reviewed by: kib, jhb
MFC after: 1 month

In nanosleep(2), note that the calling thread is put to sleep, not the
whole process. Also explicitely name the parameter that specifies
sleep interval.

Document errno codes added in r144530.

Add a new errno, ENOTCAPABLE, to be returned when a process requests an
operation on a file descriptor that is not authorized by the descriptor's
capability flags.

MFC after: 1 month
Sponsored by: Google

Add two new fcntls to enable/disable read-ahead:

- F_READAHEAD: specify the amount for sequential access. The amount is
specified in bytes and is rounded up to nearest block size.
- F_RDAHEAD: Darwin compatible version that use 128KB as the sequential
access size.

A third argument of zero disables the read-ahead behavior.

Please note that the read-ahead amount is also constrainted by sysctl
variable, vfs.read_max, which may need to be raised in order to better
utilize this feature.

Thanks Igor Sysoev for proposing the feature and submitting the original
version, and kib@ for his valuable comments.

Submitted by: Igor Sysoev <is rambler-co ru>
Reviewed by: kib@
MFC after: 1 month

Fix setfib(1) section number.

PR: 133765
Submitted by: Konstantin Zolotukhin <erebus@gorodok.net>
MFC after: 3 days

Make libc.a provide __stack_chk_fail_local weak alias. This is
needed to satisfy static libraries that are compiled with -fpic
and linked into static binary afterwards. Several libraries in
gcc are examples of such static libs.

Add EV_RECEIPT to kevents.

EV_RECEIPT is useful to disambiguating error conditions when multiple
events structures are passed to kevent(2). The error code is returned
in the data field and EV_ERROR is set.

Approved by: rwatson (co-mentor)

Add the EV_DISPATCH flag to kevents.

When the EV_DISPATCH flag is used the event source will be disabled
immediately after the delivery of an event. This is similar to the
EV_ONESHOT flag but it doesn't delete the event.

Approved by: rwatson (co-mentor)

Add EVFILT_USER to kevents.

Add user events support to kernel events which are not associated with any
kernel mechanism but are triggered by user level code. This is useful for
adding user level events to an event handler that may also be monitoring
kernel events.

Approved by: rwatson (co-mentor)

Synchornize description in manual page with strerror() output.

Eliminate a stale paragraph from the BUGS section. This "bug" was
eliminated in r195693.

Approved by: re (kensmith)

Correct AT_SYMLINK_FOLLOW flag name in linkat(2) man page.

Approved by: re (kib), ed (mentor)

Second attempt at eliminating .text relocations in shared libraries
compiled with stack protector.

Use libssp_nonshared library to pull __stack_chk_fail_local symbol into
each library that needs it instead of pulling it from libc. GCC
generates local calls to this function which result in absolute
relocations put into position-independent code segment, making dynamic
loader do extra work every time given shared library is being relocated
and making affected text pages non-shareable.

Reviewed by: kib
Approved by: re (kib)

- Change mmap() to fail requests with EINVAL that pass a length of 0. This
behavior is mandated by POSIX.
- Do not fail requests that pass a length greater than SSIZE_MAX
(such as > 2GB on 32-bit platforms). The 'len' parameter is actually
an unsigned 'size_t' so negative values don't really make sense.

Submitted by: Alexander Best alexbestms at math.uni-muenster.de
Reviewed by: alc
Approved by: re (kib)
MFC after: 1 week

Move msg{snd,recv,get,ctl} manual pages from section 3 to 2.

Approved by: re (kib)

There is an optimization in chmod(1), that makes it not to call chmod(2)
if the new file mode is the same as it was before; however, this
optimization must be disabled for filesystems that support NFSv4 ACLs.
Chmod uses pathconf(2) to determine whether this is the case - however,
pathconf(2) always follows symbolic links, while the 'chmod -h' doesn't.

This change adds lpathconf(3) to make it possible to solve that problem
in a clean way.

Reviewed by: rwatson (earlier version)
Approved by: re (kib)

- Don't suggest opening file for writing in preparation for fexecve(2).
- execve(2)/fexecve(2) won't return ETXTBSY if file is open for reading.

Approved by: re (kib)

Make it clear where to look for for protocol-specific socket options.

Reviewed by: rwatson
Approved by: re (kib)

Make the structure definitions in the man pages match the real code, and
remove no longer valid caution.

Approved by: re (kensmith)

Back out previous revision until better tested fix is ready.

Approved by: re (impliciti, by approving previos check-in)

Eliminate .text relocations in shared libraries compiled with stack protector.

Use libssp_nonshared library to pull __stack_chk_fail_local symbol into
each library that needs it instead of pulling it from libc. GCC generates
local calls to this function which result in absolute relocations put into
position-independent code segment, making dynamic loader do extra work everys
time given shared library is being relocated and making affected text pages
non-shareable.

Reviewed by: kib
Approved by: re (kensmith)

Bump manual page timestamps.

Add NFSv4 ACL support to libc.

This adds the following functions to the acl(3) API: acl_add_flag_np,
acl_clear_flags_np, acl_create_entry_np, acl_delete_entry_np,
acl_delete_flag_np, acl_get_extended_np, acl_get_flag_np, acl_get_flagset_np,
acl_set_extended_np, acl_set_flagset_np, acl_to_text_np, acl_is_trivial_np,
acl_strip_np, acl_get_brand_np. Most of them are similar to what Darwin
does. There are no backward-incompatible changes.

Approved by: rwatson@

Change the ABI of some of the structures used by the SYSV IPC API:
- The uid/cuid members of struct ipc_perm are now uid_t instead of unsigned
short.
- The gid/cgid members of struct ipc_perm are now gid_t instead of unsigned
short.
- The mode member of struct ipc_perm is now mode_t instead of unsigned short
(this is merely a style bug).
- The rather dubious padding fields for ABI compat with SV/I386 have been
removed from struct msqid_ds and struct semid_ds.
- The shm_segsz member of struct shmid_ds is now a size_t instead of an
int. This removes the need for the shm_bsegsz member in struct
shmid_kernel and should allow for complete support of SYSV SHM regions
>= 2GB.
- The shm_nattch member of struct shmid_ds is now an int instead of a
short.
- The shm_internal member of struct shmid_ds is now gone. The internal
VM object pointer for SHM regions has been moved into struct
shmid_kernel.
- The existing __semctl(), msgctl(), and shmctl() system call entries are
now marked COMPAT7 and new versions of those system calls which support
the new ABI are now present.
- The new system calls are assigned to the FBSD-1.1 version in libc. The
FBSD-1.0 symbols in libc now refer to the old COMPAT7 system calls.
- A simplistic framework for tagging system calls with compatibility
symbol versions has been added to libc. Version tags are added to
system calls by adding an appropriate __sym_compat() entry to
src/lib/libc/incldue/compat.h. [1]

PR: kern/16195 kern/113218 bin/129855
Reviewed by: arch@, rwatson
Discussed with: kan, kib [1]

Usermode portion of the support for swap allocation accounting:
- update for getrlimit(2) manpage;
- support for setting RLIMIT_SWAP in login class;
- addition to the limits(1) and sh and csh limit-setting builtins;
- tuning(7) documentation on the sysctls controlling overcommit.

In collaboration with: pho
Reviewed by: alc
Approved by: re (kensmith)

Add a limit for child jails via the "children.cur" and "children.max"
parameters. This replaces the simple "allow.jails" permission.

Approved by: bz (mentor)

In preparation for raising NGROUPS and NGROUPS_MAX, change base
system callers of getgroups(), getgrouplist(), and setgroups() to
allocate buffers dynamically. Specifically, allocate a buffer of size
sysconf(_SC_NGROUPS_MAX)+1 (+2 in a few cases to allow for overflow).

This (or similar gymnastics) is required for the code to actually follow
the POSIX.1-2008 specification where {NGROUPS_MAX} may differ at runtime
and where getgroups may return {NGROUPS_MAX}+1 results on systems like
FreeBSD which include the primary group.

In id(1), don't pointlessly add the primary group to the list of all
groups, it is always the first result from getgroups(). In principle
the old code was more portable, but this was only done in one of the two
places where getgroups() was called to the overall effect was pointless.

Document the actual POSIX requirements in the getgroups(2) and
setgroups(2) manpages. We do not yet support a dynamic NGROUPS, but we
may in the future.

MFC after: 2 weeks

Retire the unused stub for the nfsclnt() system call.

Add revoke(1).

While hacking on TTY code, I often miss a small utility to revoke my own
(pseudo-)terminals. This small utility is just a small wrapper around
the revoke(2) call, so you can destroy your very own login sessions.

Approved by: re

Add a new 'void closefrom(int lowfd)' system call. When called, it closes
any open file descriptors >= 'lowfd'. It is largely identical to the same
function on other operating systems such as Solaris, DFly, NetBSD, and
OpenBSD. One difference from other *BSD is that this closefrom() does not
fail with any errors. In practice, while the manpages for NetBSD and
OpenBSD claim that they return EINTR, they ignore internal errors from
close() and never return EINTR. DFly does return EINTR, but for the common
use case (closing fd's prior to execve()), the caller really wants all
fd's closed and returning EINTR just forces callers to call closefrom() in
a loop until it stops failing.

Note that this implementation of closefrom(2) does not make any effort to
resolve userland races with open(2) in other threads. As such, it is not
multithread safe.

Submitted by: rwatson (initial version)
Reviewed by: rwatson
MFC after: 2 weeks

Document EINVAL for bind(2).

Reviewed by: rwatson
Obtained from: SuSv3

Add hierarchical jails. A jail may further virtualize its environment
by creating a child jail, which is visible to that jail and to any
parent jails. Child jails may be restricted more than their parents,
but never less. Jail names reflect this hierarchy, being MIB-style
dot-separated strings.

Every thread now points to a jail, the default being prison0, which
contains information about the physical system. Prison0's root
directory is the same as rootvnode; its hostname is the same as the
global hostname, and its securelevel replaces the global securelevel.
Note that the variable "securelevel" has actually gone away, which
should not cause any problems for code that properly uses
securelevel_gt() and securelevel_ge().

Some jail-related permissions that were kept in global variables and
set via sysctls are now per-jail settings. The sysctls still exist for
backward compatibility, used only by the now-deprecated jail(2) system
call.

Approved by: bz (mentor)

Introduce the extensible jail framework, using the same "name=value"
interface as nmount(2). Three new system calls are added:
* jail_set, to create jails and change the parameters of existing jails.
This replaces jail(2).
* jail_get, to read the parameters of existing jails. This replaces the
security.jail.list sysctl.
* jail_remove to kill off a jail's processes and remove the jail.
Most jail parameters may now be changed after creation, and jails may be
set to exist without any attached processes. The current jail(2) system
call still exists, though it is now a stub to jail_set(2).

Approved by: bz (mentor)

With the permission of phk@ change the license on remaining jail code
to a 2 clause BSD license.

Approved by: phk
Approved by: bz (mentor)

Correct the information about when the respective functionality first
appeared in FreeBSD.

PR: 133785
Submitted by: Ulrich Spoerlein <uqs@spoerlein.net>
MFC after: 3 days

Sort man page cross references by section, no need for a comma after the
last cross reference.

MFC after: 3 days

Properly update the shm_open/shm_unlink symbol versioning metadata after
these functions were moved into the kernel:
- Move the version entries from gen/ to sys/. Since the ABI of the actual
routines did not change, I'm still exporting them as FBSD 1.0 on purpose.
- Add FBSD-private versions for the _ and __sys_ variants.

Document missing requests.

Hopefully, improve the grammar and wording in the changes to shmctl(2)
manpage and UPDATING entry 20090302.

UPDATING changes suggested by bf2006a yahoo com.
man page corrections by bde.

Correct types of variables used to track amount of allocated SysV shared
memory from int to size_t. Implement a workaround for current ABI not
allowing to properly save size for and report more then 2Gb sized segment
of shared memory.

This makes it possible to use > 2 Gb shared memory segments on 64bit
architectures. Please note the new BUGS section in shmctl(2) and
UPDATING note for limitations of this temporal solution.

Reviewed by: csjp
Tested by: Nikolay Dzham <i levsha org ua>
MFC after: 2 weeks

Add missing POSIX 1003.1-2008 open(2) flag; O_TTY_INIT.

On FreeBSD, this is the default behaviour. According to the spec, we may
give this flag a value of zero, but I'd rather not do this. If we define
it to a non-zero value, we can always change default behaviour without
changing the ABI. This is very unlikely to happen, though.

Standardize the various prison_foo_ip[46] functions and prison_if to
return zero on success and an error code otherwise. The possible errors
are EADDRNOTAVAIL if an address being checked for doesn't match the
prison, and EAFNOSUPPORT if the prison doesn't have any addresses in
that address family. For most callers of these functions, use the
returned error code instead of e.g. a hard-coded EADDRNOTAVAIL or
EINVAL.

Always include a jailed() check in these functions, where a non-jailed
cred always returns success (and makes no changes). Remove the explicit
jailed() checks that preceded many of the function calls.

Approved by: bz (mentor)

- add missing include
- fix struct memeber's name [1]

PR: docs/130413 [1]
Submitted by: Thomas Mueller <tmueller@sysgo.com> [1]
MFC after: 3 days

Document the special loopback address behaviour of jails.

PR: kern/103464
Submitted by: brueffer (correct markup)
Reviewed by: brueffer
MFC after: 2 weeks

Note that the protocol argument can be set to 0.

PR: 127890
Reviewed by: rwatson

Document that kldunloadf can return EINVAL.

PR: 125639

It's silly to claim recv(2) is to be removed in favour of recvfrom(2)
(at least at this time :) ).

Approved by: gnn (mentor)

MFp4:
Bring in updated jail support from bz_jail branch.

This enhances the current jail implementation to permit multiple
addresses per jail. In addtion to IPv4, IPv6 is supported as well.
Due to updated checks it is even possible to have jails without
an IP address at all, which basically gives one a chroot with
restricted process view, no networking,..

SCTP support was updated and supports IPv6 in jails as well.

Cpuset support permits jails to be bound to specific processor
sets after creation.

Jails can have an unrestricted (no duplicate protection, etc.) name
in addition to the hostname. The jail name cannot be changed from
within a jail and is considered to be used for management purposes
or as audit-token in the future.

DDB 'show jails' command was added to aid debugging.

Proper compat support permits 32bit jail binaries to be used on 64bit
systems to manage jails. Also backward compatibility was preserved where
possible: for jail v1 syscalls, as well as with user space management
utilities.

Both jail as well as prison version were updated for the new features.
A gap was intentionally left as the intermediate versions had been
used by various patches floating around the last years.

Bump __FreeBSD_version for the afore mentioned and in kernel changes.

Special thanks to:
- Pawel Jakub Dawidek (pjd) for his multi-IPv4 patches
and Olivier Houchard (cognet) for initial single-IPv6 patches.
- Jeff Roberson (jeff) and Randall Stewart (rrs) for their
help, ideas and review on cpuset and SCTP support.
- Robert Watson (rwatson) for lots and lots of help, discussions,
suggestions and review of most of the patch at various stages.
- John Baldwin (jhb) for his help.
- Simon L. Nielsen (simon) as early adopter testing changes
on cluster machines as well as all the testers and people
who provided feedback the last months on freebsd-jail and
other channels.
- My employer, CK Software GmbH, for the support so I could work on this.

Reviewed by: (see above)
MFC after: 3 months (this is just so that I get the mail)
X-MFC Before: 7.2-RELEASE if possible

Several cleanups related to pipe(2).

- Use `fildes[2]' instead of `*fildes' to make more clear that pipe(2)
fills an array with two descriptors.

- Remove EFAULT from the manual page. Because of the current calling
convention, pipe(2) raises a segmentation fault when an invalid
address is passed.

- Introduce kern_pipe() to make it easier for binary emulations to
implement pipe(2).

- Make Linux binary emulation use kern_pipe(), which means we don't have
to recover td_retval after calling the FreeBSD system call.

Approved by: rdivacky
Discussed on: arch

Add one more EACCES clause to rename.2.

Approved by: rwatson (mentor)

Implement support for RPCSEC_GSS authentication to both the NFS client
and server. This replaces the RPC implementation of the NFS client and
server with the newer RPC implementation originally developed
(actually ported from the userland sunrpc code) to support the NFS
Lock Manager. I have tested this code extensively and I believe it is
stable and that performance is at least equal to the legacy RPC
implementation.

The NFS code currently contains support for both the new RPC
implementation and the older legacy implementation inherited from the
original NFS codebase. The default is to use the new implementation -
add the NFS_LEGACYRPC option to fall back to the old code. When I
merge this support back to RELENG_7, I will probably change this so
that users have to 'opt in' to get the new code.

To use RPCSEC_GSS on either client or server, you must build a kernel
which includes the KGSSAPI option and the crypto device. On the
userland side, you must build at least a new libc, mountd, mount_nfs
and gssd. You must install new versions of /etc/rc.d/gssd and
/etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf.

As long as gssd is running, you should be able to mount an NFS
filesystem from a server that requires RPCSEC_GSS authentication. The
mount itself can happen without any kerberos credentials but all
access to the filesystem will be denied unless the accessing user has
a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There
is currently no support for situations where the ticket file is in a
different place, such as when the user logged in via SSH and has
delegated credentials from that login. This restriction is also
present in Solaris and Linux. In theory, we could improve this in
future, possibly using Brooks Davis' implementation of variant
symlinks.

Supporting RPCSEC_GSS on a server is nearly as simple. You must create
service creds for the server in the form 'nfs/<fqdn>@<REALM>' and
install them in /etc/krb5.keytab. The standard heimdal utility ktutil
makes this fairly easy. After the service creds have been created, you
can add a '-sec=krb5' option to /etc/exports and restart both mountd
and nfsd.

The only other difference an administrator should notice is that nfsd
doesn't fork to create service threads any more. In normal operation,
there will be two nfsd processes, one in userland waiting for TCP
connections and one in the kernel handling requests. The latter
process will create as many kthreads as required - these should be
visible via 'top -H'. The code has some support for varying the number
of service threads according to load but initially at least, nfsd uses
a fixed number of threads according to the value supplied to its '-n'
option.

Sponsored by: Isilon Systems
MFC after: 1 month

Finish what revision 1.40 started. Revision 1.40 removed a false statement
from the description but not the errors section. This revision removes it
from the errors statement.

Add a statement about the non-portability of non-page-aligned offsets.

Support for CPU sets is going to appear in 7.1 before 8.0.

MFC after: 3 days

Implement WNOWAIT flag for wait4(2). It specifies that process whose status
is returned shall be kept in the waitable state.
Add WSTOPPED as an alias for WUNTRACED.

Submitted by: Jukka Ukkonen <jau at iki fi>
PR: standards/116221
MFC after: 2 weeks

When calculating arguments to the interpreter for the shebang script
executed by fexecve(2), imgp->args->fname is NULL. Moreover, there is
no way to recover the path to the script being executed.
Do what some other U*ixes do unconditionally, namely supply /dev/fd/n
as the script path when called from fexecve(). Document requirement of
having fdescfs mounted as caveat.

Integrate the new MPSAFE TTY layer to the FreeBSD operating system.

The last half year I've been working on a replacement TTY layer for the
FreeBSD kernel. The new TTY layer was designed to improve the following:

- Improved driver model:

The old TTY layer has a driver model that is not abstract enough to
make it friendly to use. A good example is the output path, where the
device drivers directly access the output buffers. This means that an
in-kernel PPP implementation must always convert network buffers into
TTY buffers.

If a PPP implementation would be built on top of the new TTY layer
(still needs a hooks layer, though), it would allow the PPP
implementation to directly hand the data to the TTY driver.

- Improved hotplugging:

With the old TTY layer, it isn't entirely safe to destroy TTY's from
the system. This implementation has a two-step destructing design,
where the driver first abandons the TTY. After all threads have left
the TTY, the TTY layer calls a routine in the driver, which can be
used to free resources (unit numbers, etc).

The pts(4) driver also implements this feature, which means
posix_openpt() will now return PTY's that are created on the fly.

- Improved performance:

One of the major improvements is the per-TTY mutex, which is expected
to improve scalability when compared to the old Giant locking.
Another change is the unbuffered copying to userspace, which is both
used on TTY device nodes and PTY masters.

Upgrading should be quite straightforward. Unlike previous versions,
existing kernel configuration files do not need to be changed, except
when they reference device drivers that are listed in UPDATING.

Obtained from: //depot/projects/mpsafetty/...
Approved by: philip (ex-mentor)
Discussed: on the lists, at BSDCan, at the DevSummit
Sponsored by: Snow B.V., the Netherlands
dcons(4) fixed by: kan

Add prototype defination for setfib(2) to sys/socket.h.

Add EPERM to the ERRORS section.

PR: 125746

Add EAGAIN to the ERRORS list, as found in kern_jail.c.

PR: 125253
Submitted by: Mateusz Guzik <mjguzik@gmail.com> (original version)

remove whitespace bug (8 spaces into one tab)

Submitted by: ed

Fix cut-n-paste-o

Submitted by: Kostik Belousov

Update the definition of modspecific structure

PR: docs/125630

Update the ktr_header structure, which changed over time.

PR: 125546
Submitted by: Mateusz Guzik <mjguzik at gmail dot com>
MFC after: 3 days

Put the _cpuset* symbols in FBSDprivate_1.0 instead of trying to put
nonexistant __cpuset* there.

- Forgot to bump a date after last change

Make it clearer that it is possible to disable the generation of
SIGPIPE for individual sockets (PR: kern/118626).

While here, s/insure/ensure/.

- add description of the MLINK error

PR: docs/123019
MFC after: 3 days

Add Xr to getsockname(2)

Make it clearer that privilege is needed to reduce as well as
increase group membership.

Bring missing getsockopt(2) options: SO_LABEL SO_PEERLABEL SO_LISTENQLIMIT
SO_LISTENQLEN SO_LISTENINCQLEN to the manual page.

Till now those were only present in sys/socket.h file.

Reviewed by: rwatson, gnn, keramida (with mdoc hat)

Call the fcntl compatiblity wrapper from the thread library fcntl wrappers
so that they get the benefit of the (limited) forward ABI compatibility.

MFC after: 1 week

Make fcntl() a weak symbol so that it can be overridden by thread libraries.

MFC after: 2 days

Misc mdoc improvements and a typo fix.

Add setfib.2 to the list of man pages to add

setfib.2 got left out of the last commit

Add code to allow the system to handle multiple routing tables.
This particular implementation is designed to be fully backwards compatible
and to be MFC-able to 7.x (and 6.x)

Currently the only protocol that can make use of the multiple tables is IPv4
Similar functionality exists in OpenBSD and Linux.

From my notes:

-----

One thing where FreeBSD has been falling behind, and which by chance I
have some time to work on is "policy based routing", which allows
different
packet streams to be routed by more than just the destination address.

Constraints:
------------

I want to make some form of this available in the 6.x tree
(and by extension 7.x) , but FreeBSD in general needs it so I might as
well do it in -current and back port the portions I need.

One of the ways that this can be done is to have the ability to
instantiate multiple kernel routing tables (which I will now
refer to as "Forwarding Information Bases" or "FIBs" for political
correctness reasons). Which FIB a particular packet uses to make
the next hop decision can be decided by a number of mechanisms.
The policies these mechanisms implement are the "Policies" referred
to in "Policy based routing".

One of the constraints I have if I try to back port this work to
6.x is that it must be implemented as a EXTENSION to the existing
ABIs in 6.x so that third party applications do not need to be
recompiled in timespan of the branch.

This first version will not have some of the bells and whistles that
will come with later versions. It will, for example, be limited to 16
tables in the first commit.
Implementation method, Compatible version. (part 1)
-------------------------------
For this reason I have implemented a "sufficient subset" of a
multiple routing table solution in Perforce, and back-ported it
to 6.x. (also in Perforce though not always caught up with what I
have done in -current/P4). The subset allows a number of FIBs
to be defined at compile time (8 is sufficient for my purposes in 6.x)
and implements the changes needed to allow IPV4 to use them. I have not
done the changes for ipv6 simply because I do not need it, and I do not
have enough knowledge of ipv6 (e.g. neighbor discovery) needed to do it.

Other protocol families are left untouched and should there be
users with proprietary protocol families, they should continue to work
and be oblivious to the existence of the extra FIBs.

To understand how this is done, one must know that the current FIB
code starts everything off with a single dimensional array of
pointers to FIB head structures (One per protocol family), each of
which in turn points to the trie of routes available to that family.

The basic change in the ABI compatible version of the change is to
extent that array to be a 2 dimensional array, so that
instead of protocol family X looking at rt_tables[X] for the
table it needs, it looks at rt_tables[Y][X] when for all
protocol families except ipv4 Y is always 0.
Code that is unaware of the change always just sees the first row
of the table, which of course looks just like the one dimensional
array that existed before.

The entry points rtrequest(), rtalloc(), rtalloc1(), rtalloc_ign()
are all maintained, but refer only to the first row of the array,
so that existing callers in proprietary protocols can continue to
do the "right thing".
Some new entry points are added, for the exclusive use of ipv4 code
called in_rtrequest(), in_rtalloc(), in_rtalloc1() and in_rtalloc_ign(),
which have an extra argument which refers the code to the correct row.

In addition, there are some new entry points (currently called
rtalloc_fib() and friends) that check the Address family being
looked up and call either rtalloc() (and friends) if the protocol
is not IPv4 forcing the action to row 0 or to the appropriate row
if it IS IPv4 (and that info is available). These are for calling
from code that is not specific to any particular protocol. The way
these are implemented would change in the non ABI preserving code
to be added later.

One feature of the first version of the code is that for ipv4,
the interface routes show up automatically on all the FIBs, so
that no matter what FIB you select you always have the basic
direct attached hosts available to you. (rtinit() does this
automatically).

You CAN delete an interface route from one FIB should you want
to but by default it's there. ARP information is also available
in each FIB. It's assumed that the same machine would have the
same MAC address, regardless of which FIB you are using to get
to it.

This brings us as to how the correct FIB is selected for an outgoing
IPV4 packet.

Firstly, all packets have a FIB associated with them. if nothing
has been done to change it, it will be FIB 0. The FIB is changed
in the following ways.

Packets fall into one of a number of classes.

1/ locally generated packets, coming from a socket/PCB.
Such packets select a FIB from a number associated with the
socket/PCB. This in turn is inherited from the process,
but can be changed by a socket option. The process in turn
inherits it on fork. I have written a utility call setfib
that acts a bit like nice..

setfib -3 ping target.example.com # will use fib 3 for ping.

It is an obvious extension to make it a property of a jail
but I have not done so. It can be achieved by combining the setfib and
jail commands.

2/ packets received on an interface for forwarding.
By default these packets would use table 0,
(or possibly a number settable in a sysctl(not yet)).
but prior to routing the firewall can inspect them (see below).
(possibly in the future you may be able to associate a FIB
with packets received on an interface.. An ifconfig arg, but not yet.)

3/ packets inspected by a packet classifier, which can arbitrarily
associate a fib with it on a packet by packet basis.
A fib assigned to a packet by a packet classifier
(such as ipfw) would over-ride a fib associated by
a more default source. (such as cases 1 or 2).

4/ a tcp listen socket associated with a fib will generate
accept sockets that are associated with that same fib.

5/ Packets generated in response to some other packet (e.g. reset
or icmp packets). These should use the FIB associated with the
packet being reponded to.

6/ Packets generated during encapsulation.
gif, tun and other tunnel interfaces will encapsulate using the FIB
that was in effect withthe proces that set up the tunnel.
thus setfib 1 ifconfig gif0 [tunnel instructions]
will set the fib for the tunnel to use to be fib 1.

Routing messages would be associated with their
process, and thus select one FIB or another.
messages from the kernel would be associated with the fib they
refer to and would only be received by a routing socket associated
with that fib. (not yet implemented)

In addition Netstat has been edited to be able to cope with the
fact that the array is now 2 dimensional. (It looks in system
memory using libkvm (!)). Old versions of netstat see only the first FIB.

In addition two sysctls are added to give:
a) the number of FIBs compiled in (active)
b) the default FIB of the calling process.

Early testing experience:
-------------------------

Basically our (IronPort's) appliance does this functionality already
using ipfw fwd but that method has some drawbacks.

For example,
It can't fully simulate a routing table because it can't influence the
socket's choice of local address when a connect() is done.

Testing during the generating of these changes has been
remarkably smooth so far. Multiple tables have co-existed
with no notable side effects, and packets have been routes
accordingly.

ipfw has grown 2 new keywords:

setfib N ip from anay to any
count ip from any to any fib N

In pf there seems to be a requirement to be able to give symbolic names to the
fibs but I do not have that capacity. I am not sure if it is required.

SCTP has interestingly enough built in support for this, called VRFs
in Cisco parlance. it will be interesting to see how that handles it
when it suddenly actually does something.

Where to next:
--------------------

After committing the ABI compatible version and MFCing it, I'd
like to proceed in a forward direction in -current. this will
result in some roto-tilling in the routing code.

Firstly: the current code's idea of having a separate tree per
protocol family, all of the same format, and pointed to by the
1 dimensional array is a bit silly. Especially when one considers that
there is code that makes assumptions about every protocol having the
same internal structures there. Some protocols don't WANT that
sort of structure. (for example the whole idea of a netmask is foreign
to appletalk). This needs to be made opaque to the external code.

My suggested first change is to add routing method pointers to the
'domain' structure, along with information pointing the data.
instead of having an array of pointers to uniform structures,
there would be an array pointing to the 'domain' structures
for each protocol address domain (protocol family),
and the methods this reached would be called. The methods would have
an argument that gives FIB number, but the protocol would be free
to ignore it.

When the ABI can be changed it raises the possibilty of the
addition of a fib entry into the "struct route". Currently,
the structure contains the sockaddr of the desination, and the resulting
fib entry. To make this work fully, one could add a fib number
so that given an address and a fib, one can find the third element, the
fib entry.

Interaction with the ARP layer/ LL layer would need to be
revisited as well. Qing Li has been working on this already.

This work was sponsored by Ironport Systems/Cisco

PR:
Reviewed by: several including rwatson, bz and mlair (parts each)
Approved by:
Obtained from: Ironport systems/Cisco
MFC after:
Security:

PR:
Submitted by:
Reviewed by:
Approved by:
Obtained from:
MFC after:
Security:

Correct minor typos in SCTP man pages.

MFC after: 3 days

Have the man page catch up with the namespace pollution cleanup that
occurred between 2001-2003. Thanks to bde for the history lesson[1]
concerning sys/types.h and the many system calls that at one time
(pre-2001) were required by POSIX to include it.

1. http://lists.freebsd.org/pipermail/freebsd-arch/2008-April/008126.html

MFC after: 3 days

Document that you must include <sys/param.h> before <sys/cpuset.h>.

Approved by: rwatson (mentor)

Sort MAN and MLINKS.

Connect newly added manpages to the build.

Submitted by: kib

Man pages for the openat(2), fexecve(2) and related syscalls.

Reviewed by: ru

Move the cpuset functions from FBSD_1.0 to FBSD_1.1. All symbols added
to 8.0 belong in the FBSD_1.1 symbol namespace.

Add some compatibility code so that software which is built to use the new
struct flock with l_sysid member can work properly on an an old kernel which
doesn't support l_sysid.

Sponsored by: Isilon Systems

style(9) cleanup

Add the libc glue and headers definitions for the *at() syscalls.

Based on the submission by rdivacky,
sponsored by Google Summer of Code 2007
Reviewed by: rwatson, rdivacky
Tested by: pho

- Add a man page for cpuset_getaffinity() and cpuset_setaffinity() and
hook it up to the build.

Reviewed by: brueffer (skeleton and formatting assistance)

- Add a man page for cpuset(), cpuset_setid(), and cpuset_getid() and hook
it up to the build.

Reviewed by: brueffer (skeleton and formatting assistance)

Add support to mincore for detecting whether a page is part of a
"super" page or not.

Reviewed by: alc, ups

Add the new kernel-mode NFS Lock Manager. To use it instead of the
user-mode lock manager, build a kernel with the NFSLOCKD option and
add '-k' to 'rpc_lockd_flags' in rc.conf.

Highlights include:

* Thread-safe kernel RPC client - many threads can use the same RPC
client handle safely with replies being de-multiplexed at the socket
upcall (typically driven directly by the NIC interrupt) and handed
off to whichever thread matches the reply. For UDP sockets, many RPC
clients can share the same socket. This allows the use of a single
privileged UDP port number to talk to an arbitrary number of remote
hosts.

* Single-threaded kernel RPC server. Adding support for multi-threaded
server would be relatively straightforward and would follow
approximately the Solaris KPI. A single thread should be sufficient
for the NLM since it should rarely block in normal operation.

* Kernel mode NLM server supporting cancel requests and granted
callbacks. I've tested the NLM server reasonably extensively - it
passes both my own tests and the NFS Connectathon locking tests
running on Solaris, Mac OS X and Ubuntu Linux.

* Userland NLM client supported. While the NLM server doesn't have
support for the local NFS client's locking needs, it does have to
field async replies and granted callbacks from remote NLMs that the
local client has contacted. We relay these replies to the userland
rpc.lockd over a local domain RPC socket.

* Robust deadlock detection for the local lock manager. In particular
it will detect deadlocks caused by a lock request that covers more
than one blocking request. As required by the NLM protocol, all
deadlock detection happens synchronously - a user is guaranteed that
if a lock request isn't rejected immediately, the lock will
eventually be granted. The old system allowed for a 'deferred
deadlock' condition where a blocked lock request could wake up and
find that some other deadlock-causing lock owner had beaten them to
the lock.

* Since both local and remote locks are managed by the same kernel
locking code, local and remote processes can safely use file locks
for mutual exclusion. Local processes have no fairness advantage
compared to remote processes when contending to lock a region that
has just been unlocked - the local lock manager enforces a strict
first-come first-served model for both local and remote lockers.

Sponsored by: Isilon Systems
PR: 95247 107555 115524 116679
MFC after: 2 weeks

Fix bugs in previous revision (missing comma, misspelled syscall name).

- Remove kse syscall symbols and man pages.

Add reference to kldunloadf system call, which was previously not
mentioned in the kldunload(2) man page.

MFC after: 3 days
Spotted by: rink

Introduce a new F_DUP2FD command to fcntl(2), for compatibility with
Solaris and AIX.
fcntl(fd, F_DUP2FD, arg) and dup2(fd, arg) are functionnaly equivalent.
Document it.
Add some regression tests (identical to the dup2(2) regression tests).

PR: 120233
Submitted by: Jukka Ukkonen
Approved by: rwaston (mentor)
MFC after: 1 month

Add cpuset, an api for thread to cpu binding and cpu resource grouping
and assignment.
- Add a reference to a struct cpuset in each thread that is inherited from
the thread that created it.
- Release the reference when the thread is destroyed.
- Add prototypes for syscalls and macros for manipulating cpusets in
sys/cpuset.h
- Add syscalls to create, get, and set new numbered cpusets:
cpuset(), cpuset_{get,set}id()
- Add syscalls for getting and setting affinity masks for cpusets or
individual threads: cpuid_{get,set}affinity()
- Add types for the 'level' and 'which' parameters for the cpuset. This
will permit expansion of the api to cover cpu masks for other objects
identifiable with an id_t integer. For example, IRQs and Jails may be
coming soon.
- The root set 0 contains all valid cpus. All thread initially belong to
cpuset 1. This permits migrating all threads off of certain cpus to
reserve them for special applications.

Sponsored by: Nokia
Discussed with: arch, rwatson, brooks, davidxu, deischen
Reviewed by: antoine

Use the easily-greppable copyright notice template from
src/share/examples/mdoc/POSIX-copyright.

Requested by: ru

Added the "restrict" type-qualifier to the readlink() prototype.

Add missing words.

MFC after: 3 days

Note, as required by our agreement with IEEE/The Open Group, that the message
queue manual pages excerpt the POSIX standard.

Spotted by: Mindaugas Rasiukevicius <rmind -at- NetBSD.org>
Reviewed by: imp
MFC after: 1 day

Change readlink(2)'s return type and type of the last argument
to match POSIX.

Prodded by: Alexey Lyashkov

After issueing a ntpdate [1] I noticed it's already 2008, reflect that
in the last modified date.

Noticed by: brueffer [1]

Fix typo (s/existance/existence/)

Noticed by: ceri

Give sendfile(2) a SF_SYNC flag which makes it wait until all mbufs
referencing the files VM pages are returned from the network stack,
making changes to the file safe.

This flag does not guarantee that the data has been transmitted to the
other end.

Update this manual page to describe the extattr_list_file() and the
extattr_list_fd() functions.

PR: 108142
Submitted by: Richard Dawe <rich@phekda.gotadsl.co.uk>
Reviewed by: kientzle

Xref flopen.3 which references this manual page.

PR: 112650

Fix some style nits.

Prodded by: brueffer
MFC After: 3 days

Add a new file descriptor type for IPC shared memory objects and use it to
implement shm_open(2) and shm_unlink(2) in the kernel:
- Each shared memory file descriptor is associated with a swap-backed vm
object which provides the backing store. Each descriptor starts off with
a size of zero, but the size can be altered via ftruncate(2). The shared
memory file descriptors also support fstat(2). read(2), write(2),
ioctl(2), select(2), poll(2), and kevent(2) are not supported on shared
memory file descriptors.
- shm_open(2) and shm_unlink(2) are now implemented as system calls that
manage shared memory file descriptors. The virtual namespace that maps
pathnames to shared memory file descriptors is implemented as a hash
table where the hash key is generated via the 32-bit Fowler/Noll/Vo hash
of the pathname.
- As an extension, the constant 'SHM_ANON' may be specified in place of the
path argument to shm_open(2). In this case, an unnamed shared memory
file descriptor will be created similar to the IPC_PRIVATE key for
shmget(2). Note that the shared memory object can still be shared among
processes by sharing the file descriptor via fork(2) or sendmsg(2), but
it is unnamed. This effectively serves to implement the getmemfd() idea
bandied about the lists several times over the years.
- The backing store for shared memory file descriptors are garbage
collected when they are not referenced by any open file descriptors or
the shm_open(2) virtual namespace.

Submitted by: dillon, peter (previous versions)
Submitted by: rwatson (I based this on his version)
Reviewed by: alc (suggested converting getmemfd() to shm_open())

Add note about other systems.

Make the warning a bit less 'broad' then it used to be. The access
is seems to be a problem for SUID applications, which we like to
prevent as much as possible.

PR: docs/39530
Submitted by: Soren Spies <sspies at apple dot com>
MFC After: 3 days

Remove extraneous empty lines, to fix mdoc warnings.

MFC after: 3 days

Bump manpage date, missed during the last change.

MFC after: 3 days

The .Fx request doesn't recognize 2.2.0, so use ".Fx 2.2"

MFC after: 3 days

Add a BUGS section to note that mount/chroot changes since
a module was loaded might make the pathname inaccurate.

I wonder if an inode reference should be stored with the pathname
to allow a validity check?

Suggested by: rwatson@

Add the full module path name to the kld_file_stat structure
for kldstat(2).

This allows libdtrace to determine the exact file from which
a kernel module was loaded without having to guess.

The kldstat(2) API is versioned with the size of the
kld_file_stat structure, so this change creates version 2.

Add the pathname to the verbose output of kldstat(8) too.

MFC: 3 days

Add FreeBSD history.

Approved by: re(ken)

Use better manuals for these ntp system calls. These were replaced by
the netbsd versions, and tweaked by me with suggestions from phk.

Reviewed by: phk
Approved by: re@

We've been able to support EVFILT_VNODE filtering on non-UFS
file systems since 2005.

Submitted by: Igor Sysoev
Approved by: re (bmah)
MFC after: 3 days

Add thr_kill2 syscall.

Submitted by: Tijl Coosemans tijl at ulyssis dot org
Approved by: re (kensmith)

Take a sentence into the present by removing a reference to FreeBSD 3.0.

Approved by: re (blanket)
MFC after: 3 days

Change the C wrappers for mmap/lseek/pread/pwrite/truncate/ftruncate to
call the pad-less versions of the corresponding syscalls if the running
kernel supports it. Check kern.osreldate once per program and cache the
result to select the appropriate syscall. This maintains userland
compatability with kernel.old's from quite a while back.

Approved by: re (kensmith)

Classify mmap, lseek, pread, pwrite, truncate, ftruncate as pseudo
syscalls, unless WITHOUT_SYSCALL_COMPAT is defined. The default case
will have the .c wrappers still. If you define WITHOUT_SYSCALL_COMPAT,
the .c wrappers will go away and libc will make direct syscalls.

After 7-stable starts, the direct syscall method will be default.

Approved by: re (kensmith)

Fix library names.

Catch up with the code.

Submitted by: peter

Expose __stack_chk_fail_local() so -fstack-protector-all works.

Correct spelling errors in comments.

Follow NetBSD, OpenBSD and DragonfyBSD project and add BSD-licensed
SSP functions into FreeBSD libc. Use the same file name and location
for consistency with other projects.

Document RFTHREAD

PR: docs/78915
Submitted by: Marc Olzheim <marcolz@stack.nl>
MFC after: 1 week

Add missing links and sort.

Use C comments since we now preprocess these files with CPP.

Remove the MSG_PEEK flag from the documentation of the send(2) syscall -
it is only relevant to receiving data from sockets, not to sending.

PR: 109667
Submitted by: Jari Kirma <kirma@cs.hut.fi>
Approved by: wollman

Belatedly bump Dd for my recent changes.

Document PT_GETNUMLWPS.

Describe PT_GETLWPLIST's arguments.

Bump date.

Implement SEEK_DATA and SEEK_HOLE extensions to lseek(2) as found in
OpenSolaris. For more information please refer to:

http://blogs.sun.com/bonwick/entry/seek_hole_and_seek_data

Wordsmithery.

Pointed out by: ru

Document SO_ACCEPTCONN.

Submitted by: Vlad GALU (with changes)
MFC after: 3 days

Fix license. Clause 4 is still required (UCB materiel).

Submitted by: rwatson
Pointy hat to: bms

use 2-clause BSD license as per hoskins strike-off july 22 1999.
use wording of FreeBSD License.

Apply my patch properly.

Fix markup.

Submitted by: ru
MFC after: 2 days

.Xr nit.

Submitted by: brueffer

Update shutdown() manual page to reflect actual behaviour of code.

Add IMPLEMENTATION NOTES section explaining in detail the effect this
system call has in common use cases involving PF_INET and PF_INET6 sockets.

PR: kern/84761
MFC after: 2 days

Fix include declaration it was sys/sctp.h should be netinet/sctp.h,
reported by pluknet@gmail.com.

First cut of the sctp man pages. Still need work.

Fix mis-reference of incorrect manual page in ERRORS section.

Noticed by: Harlan Stenn <stenn@ntp.isc.org>

New sentence -> new line. While here, fix apostrophe abuse.

Change the date.

Make the kse man page reflect the removal of the KSEGRP kernel abstraction.

Docment the acceptable values for the id parameter.

When we try to set set-gid bit with chmod(2) on a file, which we own, but our
effective group ID (and any of our group) doesn't match the group ID of the
file, we get EPERM. This doesn't conform POSIX. POSIX requires that we should
return 0, but silently clear the set-gid bit.

Remove 3rd clause, renumber, ok per email

o Document SO_TIMESTAMP and SO_BINSTAMP socket options.

PR: docs/107696
Submitted by: Rob Robertson
Reviewed by: ru
Obtained from: NetBSD (mostly)
MFC after: 1 week

Per Regents of the University of Calfornia letter, remove advertising
clause.

# If I've done so improperly on a file, please let me know.

Be more specific in ENXIO description:
- O_NONBLOCK flag has to be set, if it is not set, open(2) will wait for
another process opening the fifo for reading,
- Use O_WRONLY which implies that the file has to be opened _only_ for write.

open(2) returns EROFS when O_CREAT is specified and the named file would
reside on a read-only file system.

- POSIX mentions that EACCES can be returned when O_TRUNC is specified
separately. Do the same.
- Document when EPERM can be returned.

Prefer "to be modified" over "to be opened for writing".
This is quite tricky situation, because we allow to open a file with
O_RDONLY|O_TRUNC. O_TRUNC modifies a file, but we actually don't open
it for writing. EISDIR is also returned when we try to open a directory
O_RDONLY|O_TRUNC, which is correct.
POSIX says that "The result of using O_TRUNC with O_RDONLY is undefined.",
we choose to accept it (Solaris did the same), that's why "to be modified"
seems more accurate to me.

Bump modification date for last update.

Catch up struct cmsghdr and struct msghdr in the manual page with the
actual structures in socket.h (which were updated 7 years ago).

MFC after: 1 week

chflags(2) returns EPERM when user tries to set or remove the SF_SNAPSHOT flag.

- truncate(2) returns EFBIG if the length argument was greater than the
maximum file size.
- truncate(2) returns EINVAL if the length argument was less than 0.

Append-only flag also denies chown(2).

Much more correct EFTYPE description.

Better wording.

Append-only flag also denies chmod(2). Is this correct behaviour?

Be more precise with EPERM description. When chown(2) is a no-op, it will
return 0.

Write permission if of course only needed for the parent directory of
the object beeing created.

Pointed out by: bde

mkfifo(2) returns EACCES when write permission is denied for a component of
the path prefix.

Be more specific when ELOOP can be returned.

symlink(2) return EACCES if a component of the name2 path prefix denies
write permission.

Correct ENOENT description.

The 'name1' argument to symlink(2) is only limited to 1023 characters,
its components are not checked.

mkdir(2) creates directory, not file.

Remove reference to confusing behaviour just removed from
the kse_exit() syscall. Describe the correct behaviour.

When directory is given as an argument for unlink(2), EPERM is returned
not matter if this is regular directory or a mount point.

If the named file has its immutable or append-only flag set, utimes(2)
returns EPERM.

If the parent directory of the named file has its immutable flag set,
mkfifo(2) returns EPERM.

If the parent directory of the destination file has its immutable flag set,
symlink(2) returns EPERM.

- If the source file has its immutable or append-only flag set, link(2)
returns EPERM.
- If the parent directory of the destination file has its immutable flag set,
link(2) returns EPERM.

If the named file has its immutable or append-only flag set, truncate(2)
and ftruncate(2) return EPERM.

Note, that if the append-only flag is set even increasing size of the file
is not permitted.

If the named file has its immutable flag set, chown(2) returns EPERM.

If the named file has its immutable flag set, chmod(2) returns EPERM.

Add reference to chflags(2).

If the parent directory of the named file has its immutable flag set,
mkdir(2) returns EPERM.

- If the directory to be removed has its immutable, undeletable or append-only
flag set, rmdir(2) returns EPERM.
- If the parent directory of the directory to be removed has its immutable or
append-only flag set, rmdir(2) returns EPERM.

- If the parent directory of the file pointed at by the from argument has its
immutable or append-only flag set, rename(2) returns EPERM.
- If the parent directory of the file pointed at by the to argument has its
immutable flag set, rename(2) returns EPERM.

Correct last commit. The parent directory of the file to be removed can
have undeletable flag set.

When immutable, undeletable or append-only flag is set, rename(2)
return EPERM.

When undeletable flag is set, unlink(2) return EPERM.

Grammar.

OK'ed by: sam

document recent change to return ECONNRESET for tcp sockets

MFC after: 1 month

Note that, thanks to the work by Alan Cox et al, some arch'es
don't need sendfile() buffers any more.

The report on the work referenced can be found at
http://usenix.org/events/usenix05/tech/general/elmeleegy.html

MFC after: 1 week

Document that the data field for NOTE_EXIT holds the process exit status.

Submitted by: Jared Yanovich -phirerunner at comcast.net-
MFC after: 2 weeks

Add an entry for PT_GETLWPLIST.

Nudged by: jhb
Reviewed by: davidxu

Remove sys/uio.h include -- this is no longer required by the extattr
system call API.

MFC after: 3 weeks

- clock_gettime is in time.h instead of sys/time.h

Approved by: trhodes (mentor), keramida (mentor)
PR: docs/104707
MFC-after: 3 days

Replace the SEE ALSO xrefs with a more reasonable set stolen from POSIX.

Document MNT_GJOURNAL option.

Minor markup fix: A comma should be seperated by space from macro
argument. This resulted in "pwritev,()" instead of the intended
"pwritev()," in the output.

MFC after: 3 days

Avoid a potential hard sentence break.

Use normal parentheses.

PR: docs/84549
Submitted by: Gary W. Swearingen
MFC after: 3 days

Link select(2) to FD_CLR(3), FD_ISSET(3), FD_SET(3), and FD_ZERO(3).

PR: docs/57974
MFC after: 3 days

Document S_IRWXU and permission bits for group/other.

PR: docs/57153
MFC after: 3 days

o Follow the trend and try to explain what the slow device is.
Not ideal but better than nothing.

Obtained from: OpenBSD, NetBSD

Reword previous delta a little bit.

Submitted by: ru

Fix ambiguity in description. Note that the aio_return() system call should
only be called once after failure or completion of an AIO request. Bump doc
date while I'm here.

Noticed by: Samy Al Bahra

Add missing word "returns."

Noticed by: Samy Al Bahra

Fix markup, language, function prototype, and example code.

Fix typo

PR: docs/103666
Submitted by: vd
Approved by: maxim

remove thr_getscheduler, thr_setscheduler, thr_setschedparam,
add rtprio_thread.

Markup fixes.

Remove more traces of Alpha.

Remove reference to T/TCP.

Reviewed by: andre

Fix a typo

Note that the system only allows a maximum of kern.kq_calloutmax timers.

PR: docs/102353
Submitted by: phk
MFC after: 1 week

Document EAGAIN failure per PR. (Finally!)

PR: 24125

We operate on 'statfs' structures, not on 'fsstat' structures.

MFC after: 3 days

Commit the results of the typo hunt by Darren Pilgrim.
This change affects documentation and comments only,
no real code involved.

PR: misc/101245
Submitted by: Darren Pilgrim <darren pilgrim bitfreak org>
Tested by: md5(1)
MFC after: 1 week

Add missing ;.

Pointy hat to: myself
Approved by: deischen (implicitly)

Add missing syscalls.

Reviewed by: deischen
Approved by: deischen

Make the mincore(2) return ENOMEM when requested range is not fully mapped.

Requested by: Bruno Haible <bruno at clisp org>
Reviewed by: alc
Approved by: pjd (mentor)
MFC after: 1 month

o Sort .Xrs.

Add xref to statfs(2)

o Document the fact truncate(2) has no effect for !VDIR or !VREG files.

Submitted by: ceri

Remove reference to "System call restart" in intro(2). intro(2) does not
have such a reference. Add a reference instead to SA_RESTART in
sigaction(2).

* Document the fact that non-superusers cannot change file flags for
objects with SF_IMMUTABLE, SF_APPEND, or SF_NOUNLINK.
* Document that non-superusers cannot set or clear any SF_* flag
(setting fails with EPERM, clearing is silently ignored).
* Document that superusers cannot change any flag if one of
SF_IMMUTABLE, SF_APPEND, SF_NOUNLINK is set and securelevel is
greater than 0.
* Document SF_SNAPSHOT and note that it is maintained by the
system and is, for this reason, impossible to set to clear by
any user.

PR: docs/33877
Submitted by: harti
Help by: George Marsellis <gam9478@njit.edu>
MFC after: 1 week

Update for rev 1.205 of vm_mmap.c.

Submitted by: fanf

o Document SO_NOSIGPIPE, touch .Dd.

PR: docs/78479
Submitted by: Mikko Tyolajarvi
MFC after: 2 weeks

List pwritev in the NAME section.

Document that the documented 2GB mmap limit is actually a
documentation bug. We switched to page indexes some time around
FreeBSD 2.2. The actual 'len' limit is the maximum file size or what
will fit in your address space, whichever comes first. It should be
possible to make 1TB files on 32 bit systems, but of course address space
runs out long before then.

Add each directory's symbol map file to SYM_MAPS.

Add symbol maps and initial symbol version definitions to libc.

Reviewed by: davidxu

Remove mq.c, the POSIX mqueue is implemented in librt.

Suggested by: deischen

Remove a useless word.

PR: 94087
Submitted by: Tadaaki Nagao <nagao@iij.ad.jp>
MFC after: 3 days

Sync with actual code.

PR: docs/87681
Noticed by: Andreas Kohn <andreas@syndrom23.de>
Reviewed by: brooks
Approved by: trhodes (mentor)
MFC after: 3 days

Disconnect mqueue from buildworld, as I will implement it in seperated
library.

Tell the truth about a) how to get the first fileid, and
b) what return values from kldstat(2) can be expected.

Bump .Dd.

MFC after: 3 days

- Massage wording to make it easier to understand and fix some grammar.

Submitted by: sbahra at gwu dot edu
Reviewed by: ru@
Approved by: ceri@
MFC after: 3 days

- In pipe() return the error returned by pipe_create(), rather then
hardcoded ENFILES, which is incorrect. pipe_create() can fail due
to ENOMEM.
- Update manual page, describing ENOMEM return code.

Reviewed by: arch

Back out the previous change to rename.2. The previous rename()
behaviour of returning EINVAL when ".." is passed as either argument
has been restored.

rmdir("..") now returns EINVAL instead of EPERM. Document the
previously undocumented behaviour of rmdir(".") returning EINVAL
as required by POSIX and SUSv3. Bump the man page change date.

undelete("..") now returns EINVAL instead of EPERM. Bump the man
page change date.

MFC after: 3 days

rename(), rmdir(), and undelete() fail with EPERM if the last component
of the path is "..".

MFC after: 3 days

Add references to fhopen, fhstat, getfh, lgetfh and fhstatfs.

Pointed out by: Antony Curtis <antony@mysql.com>

Document the recently-added EINVAL behavior.

MFC after: 1 week

Add abort2 manual page.

Submitted by: "Wojciech A. Koszek" <dunstan@freebsd.czest.pl>
Edited by: phk

Sort .Xr by section number.

Submitted by: ru

Add cross references to siginfo.3.

Fix markeup.

Submitted by: ru

Fix markup.

Submitted by: ru

Document SIGEV_NONE and SIGEV_SIGNAL.

Fix prototype.

Fix type of argument.

Break hard sentence break.

Remove implementation-defined, it has already been described in NOTES
section.

Remove implementation-defined sentences.

Fix lots of markup and content bug.

Submitted by: ru

syscall -> system call.

Fix markup.

Tweak markup for POSIX standards. Minor wordsmithing.

Submitted by: ru@

Document O_NOCTTY and O_SYNC. O_NOCTTY is a nop on freebsd, while on
other systems it prevents a tty from becoming a controlling tty on the
open. O_SYNC is the POSIX name for O_FSYNC.

The Markup Police may need to tweak my references to standards.

Update conformance and history sections.

Symlink mq_send to mq_timedsend.
Symlink mq_receive to mq_timedreceive.

Add manuals for POSIX message queue.

Implement following POSIX message queue interfaces:
mq_close, mq_getattr, mq_receive, mq_send.

Make SYNOPSIS compile.

Attn peter@: this manpage wasn't synced with your code changes.

Fix prototypes.

Attn davidxu@: most likely, the description should also be tweaked
after your undocumented changes that changed these prototypes.

Do not explicitly state how many bytes an argument list can be in the
description of E2BIG, since it's now larger on some platforms.

MFC after: 3 days

Document CLOCK_UPTIME which returns the current uptime in SI seconds.
At the moment it is just an alias for CLOCK_MONOTONIC which reports
the same number.

Sponsored by: TCP/IP Optimization Fundraise 2005

Fix up markup etc. in recently born manpage.

-mdoc sweep.

add continued status.

Insert missing copyright headers.

Only signo should be marked with .Fa.

Fix plural.

Fix plural.

Fix copy-paste issue.

Add POSIX timer manuals.

Add descriptions about signal queue.

Er, highlight function wait().

Add notes about queued SIGCHLD.

Add manuals for sigqueue, sigtimedwait, sigwaitinfo.