Avoid overflow when computing kern.ipc.shmmax. Keep shmmax (bytes) and
shmall (pages) values aligned and use arithmetic everywhere instead
of shifts.
Should fix PR 57979

simpler fix for the race between shmat() and shmdt():
change shmat() to hold shm_lock until it is completely done.

revert rev 1.139 (fixing a race between shmat() and shmdt())
that approach turned out to be too complicated.

in shmdt(), wait until shmat() completes before detaching.

Reported-by: syzbot+8f470a1bf36b47ae0040@syzkaller.appspotmail.com
Reported-by: syzbot+45810b4c41ed65d9148d@syzkaller.appspotmail.com

Fix stupid bugs in linux_sys_shmctl(): the index could be out of bound
(page fault) and there was no proper locking.

Maybe we should just remove LINUX_SHM_STAT, like compat_linux32.

Many years ago someone created a new __link_set_sysctl_funcs to hold
the list of routines that need to be called for setting up sysctl
variables. This worked great for all code included in the kernel
itself, but didn't deal with modules that want to create their own
sysctl data. So, we ended up with a lot of #ifdef _MODULE blocks
so modules could explicitly call their setup functions when loaded
as non-built-in modules.

So today, we complete the task that was started so many years ago.

When modules are loaded, after we've called xxx_modcmd(INIT...) we
check if the module contains its own __link_set_sysctl_funcs, and
if so we call the functions listed. We add a struct sysctllog member
to the struct module so we can call sysctl_teardown() when the module
gets unloaded. (The sequence of events ensures that the sysctl stuff
doesn't get created until the rest of the module's init code does any
required memory allocation.)

So, no more need to explicitly call the sysctl setup routines when
built as a loadable module.

Acquire shmseg uobj reference while we hold shm_lock.

Otherwise nothing prevents it from being detached under our feet when
we drop shm_lock.

Reported-by: syzbot+a76c618a6808a0fda475@syzkaller.appspotmail.com

branches: 1.135.2;
shmctl(SHM_LOCK) does not need to mess with mappings of the shm segment,
uvm_obj_wirepages() is sufficient. this fixes the problem reported in
https://syzkaller.appspot.com/bug?id=71f9271d761f5b6ed517a18030dc04f0135e6179

Replace some "panic()" calls with simple "printf() ; return error"

There's no good reason for these build-time parameters to be allowed to
panic the kernel when it is easy to simply disable the module code and
fail gracefully.

While we're at it, similarly replace panic() when malloc fails to also
fail gracefully.

for sysv ipc stat operations, explicitly copy the exported parts
instead of the whole ds structure.

besides triggering a recently added assert in netbsd32, this stops
exposing kernel addresses.

copy the mode clamping to 0777 from sem to shm and msg.


while here, make sure that the compat callers to sysv_ipc clear
the contents of the compat structure before setting the result
members to ensure padding bytes are cleared.

don't set/copy _sem_base, _msg_first, _msg_last or _shm_internal.
even if used, which seems very dodgy, they leak KVAs as well.
possibly this may affect linux binaries, in particular, the
comments around _shm_internal ("XXX Oh well.") may mean apps
rely upon these but hopefully not -- the comments date back to
rev 1.1 in 1995.

the _key, _seq and _msg_cbytes members are exported as before as
i found multiple consumers of these (no less than ipcs(1), and
they appear to be useful for debugging and more.


XXX: the naming of compat functions have too many styles. there
are at least 3 different ones changed here.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.131.10; 1.131.16; 1.131.18;
We never exec(2) with a kernel vmspace, so do not test for that, but instead
KASSERT() that we don't.
When calculating the load address for the interpreter (e.g. ld.elf_so),
we need to take into account wether the exec'd process will run with
topdown memory or bottom up. We can not use the current vmspace's flags
to test for that, as this happens too early. Luckily the execpack already
knows what the new state will be later, so instead of testing the current
vmspace, pass the info as additional argument to struct emul
e_vm_default_addr.
Fix all such functions and adopt all callers.

In sysv_sem.c, defer establishment of exithook so we can initialize the
module code from module_init() rather than waiting until after calling
exec_init(). Use a RUN_ONCE routine at entry to each sys_sem* syscall
to establish the exithook, and no longer KASSERT that the hook has
been set before removing it. (A manually loaded module can be unloaded
before any syscalls have been invoked.)

Remove the conditional calls to the various xxx_init() routines from
init_main.c - we now rely on module_init() to handle initialization.

Let each sub-component's xxx_init() routine handle its own sysctl
sub-tree initialization; this removes another set of #ifdef ugliness.

Tested both built-in and loadable versions and verified that atf
test kernel/t_sysv passes.

Now that SYSVSHM is modularized, reattach the linkages from uvm so that
we can correctly clean up on process exit or fork.

Without this, firefox attaches to a shared memory segment but doesn't
detach before exit. Thus once firefox causes an autoload for sysv_ipc
it cannot be unloaded since the segment still retains references.

More prep: add a xxxfini() routine to each subcomponent so we can
clean up after ourselves. Mostly, this checks to make sure that
there are no active itmes, and then deallocates wired kernel virtual
memory. For SYSVSEM, we also disestablish the exithook() so we
won't try to call it after destroying its memory pool!

More preparation for modularizing the SYSVxxx options. Here we
change the kern.ipc.sysvxxx sysctls into dynamic values, so each
sub-component of SYSVxxx can declare its own availability.

In preparation for modularization of the SYSV* options, restore the
use of opt_sysv.h to get the -DSYSVxxx definitions.

branches: 1.125.2; 1.125.4; 1.125.6; 1.125.10;
In shmrealloc(), add missing condvar initialisations for segments
copied from previous location.

branches: 1.124.2;
Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

branches: 1.123.2; 1.123.4;
Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

branches: 1.122.2; 1.122.6;
Add an optional pglist argument to uvm_obj_wirepages, to be
filled with the list of pages that were wired.

Correct sizes to pass uvm_km_free(9) in error paths.

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.119.2;
- Replace shmmap_entry_pool with kmem(9), as pool is not worth.
- Sprinkle __cacheline_aligned and __read_mostly.

branches: 1.118.2;
Use 'z' printf format modifier to print size_t in debug code.

branches: 1.117.2; 1.117.4;
shmexit: simplify a lot by avoiding unnecessary memory allocations, since
it is a last reference, just re-lock and check mapping list again. Often
there wont be re-locks at all, moreover, shm_lock is not contended at all.

Remove SHMMAXPGS from all kernel configs. Dynamically compute the
initial limit as 1/4 of the physical memory. Ensure the limit is at
least 1024 pages, the old default on most platforms.

branches: 1.115.2;
merge christos-time_t

sys_shmat: initialise shmid of shmmap entry earlier. Now error path,
i.e. shm_delete_mapping, wont use random value.

branches: 1.113.2;
Change the order of error checks in shmget so EEXIST is returned before
EINVAL or EACCESS so callers have a more reliable way to tell if a
shared memory segment already exists.

branches: 1.112.2;
- Allow changing of kern.ipc.shmmax, just to avoid confusion.
- Change type of kern.ipc.shmmax to CTLTYPE_QUAD.

Fix the aligning of memory blocks again, finally...
Tested by <martin> on his sparc64 box.

branches: 1.110.4;
shmrealloc: destroy condition variables before freeing them.

sys_shmget: use the correct size variable for uobj_wirepages().
Adjust shm_memlock() for consistency too.

Fixes PR/38782, reported by Adam Hoka.

sys_shmget: fix an object leak in case of error.

branches: 1.107.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.106.2; 1.106.4;
Fix shared memory code that it could handle > 4GB addresses correctly.
PR/38109, patch (a little bit modified) from Chris Brand.

branches: 1.105.6; 1.105.8;
Fix shm_cv/newshm_cv offset value by using the correct sizeof argument
(kcondvar_t -> struct shmid_ds).

ok by rmind@

- sys_shmget: size type must be size_t, not int. Should avoid possible
problems with huge allocations.
- shmrealloc: use newshmni for calculation of new sz, shminfo.shmmni
was a mistake. Convert sz to size_t type.

Patch up sysctl locking:

- Lock processes, credentials, filehead etc correctly.
- Acquire a read hold on sysctl_treelock if only doing a query.
- Don't wire down the output buffer. It doesn't work correctly and the code
regularly does long term sleeps with it held - it's not worth it.
- Don't hold locks other than sysctl_lock while doing copyout().
- Drop sysctl_lock while doing copyout / allocating memory in a few places.
- Don't take kernel_lock for sysctl.
- Fix a number of bugs spotted along the way

Merge vmlocking2 to head.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.100.8; 1.100.14; 1.100.16; 1.100.20;
fix typos

branches: 1.99.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.98.2;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

TRUE -> true, FALSE -> false

branches: 1.96.2;
Replace some uses of lockmgr() / simplelocks.

Merge newlock2 to head.

PR/28458: shmat(2) shmaddr argument is not honored as intended.
Patch applied, thanks for Minoura Makoto.

Please note, that one should fail if cannot attach to shmaddr,
but not attach it to other place.

OK by uwe@

Avoid sleeping with a held simple_lock.

PR/34837: Mindaguas: Add SysV SHM dynamic reallocation and locking to the
physical memory

remove some __unused from function parameters.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.89.4; 1.89.6;
Use the LWP cached credentials where sane.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.87.2;
integrate kauth.

branches: 1.86.4; 1.86.6; 1.86.8; 1.86.10; 1.86.12;
Use ANSI function delcs.

fix debugging; remove some defines that are now in the header file.

branches: 1.84.2;
merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

Fix some things regarding COMPAT_NETBSD32 and limits/VM addresses.

* For sparc64 and amd64, define *SIZ32 VM constants.
* Add a new function pointer to struct emul, pointing at a function
that will return the default VM map address. The default function
is uvm_map_defaultaddr, which just uses the VM_DEFAULT_ADDRESS
macro. This gives emulations control over the default map address,
and allows things to be mapped at the right address (in 32bit range)
for COMPAT_NETBSD32.
* Add code to adjust the data and stack limits when a COMPAT_NETBSD32
or COMPAT_SVR4_32 binary is executed.
* Don't use USRSTACK in kern_resource.c, use p_vmspace->vm_minsaddr
instead (emulations might have set it differently)
* Since this changes struct emul, bump kernel version to 3.99.2

Tested on amd64, compile-tested on sparc64.

branches: 1.82.4; 1.82.6; 1.82.10;
fix typo (missing &)

use nointr allocator for shmmap_entry_pool - this is always accessed
from process context

kill the indirection via struct shm_handle and store pointer to the uvm
object direct to _shm_private; the indirection doesn't serve any
useful purpose and just wastes memory and cpu cycles

add flag for shmget(2) to specify that later shmat(2) for the shared memory
segment should succeed even if the segment would be marked removed; use this
to implement the Linux-compatible semantics of shmat(2)

this fixes the old Linux VMware3 graphics problem with local display,
and possibly other local Linux X clients using MIT-SHM

fold shmat1() back into sys_shmat(), the change in rev 1.64 is not sufficient
for Linux-compatible shmat() behaviour - shmat() for the removed shared memory
segment must work from all callers, the shared memory id could be passed e.g.
to native X server via MIT-SHM

temporarily remove the functionality, the Linux-compatible semantics
will be reimplemented differently

Initialise (most) pools from a link set instead of explicit calls
to pool_init. Untouched pools are ones that either in arch-specific
code, or aren't initialiased during initial system startup.

Convert struct session, ucred and lockf to pools.

branches: 1.76.2;
- Nuke __P().
- Drop trailing spaces.

include <uvm/uvm_object.h> for the benefit of ports that don't include
it in <machine/pmap.h>

- Don't use uao_ functions directly; use them through the pgops methods.
- Fix missing reference leak in the error path of shmat() mentioned in
Full-Disclosure.

Wrap long line.

add #ifdef DEBUG segnum sanity check in shm_delete_mapping()

allocate virtual memory for SYSV shm, msg and semaphore structures
separately from the bufpages, so that it would be possible to eventually
make their limits changeable in runtime

make static all local variables which do not need to be exported to other
kernel parts

Fix the "COW" case if a process does a detach() between fork()
and exit(): we have to lookup the entry in the private copy
again, otherwise the wrong list is manipulated.
should fix a panic on postgres shutdown reported by Marc Recht

being here, improve sone debug messages

Make per-process shm segment descriptor magement scale better for large
shminfo.shmseg, in view of the fact that only few processes utilize a
significant fraction of it:
-turn the table into a linked list, elements allocated from a pool(9)
-On fork(), just bump a refcount instead of copying the list; it will
be decremented on exit() and exec(). Only copy if an attach or detach
takes place in between, which is rarely the case.

branches: 1.68.2;
Introduce "top down" memory management for mmap()ed allocations. This
means that the dynamic linker gets mapped in at the top of available
user virtual memory (typically just below the stack), shared libraries
get mapped downwards from that point, and calls to mmap() that don't
specify a preferred address will get mapped in below those.

This means that the heap and the mmap()ed allocations will grow
towards each other, allowing one or the other to grow larger than
before. Previously, the heap was limited to MAXDSIZ by the placement
of the dynamic linker (and the process's rlimits) and the space
available to mmap was hobbled by this reservation.

This is currently only enabled via an *option* for the i386 platform
(though other platforms are expected to follow). Add "options
USE_TOPDOWN_VM" to your kernel config file, rerun config, and rebuild
your kernel to take advantage of this.

Note that the pmap_prefer() interface has not yet been modified to
play nicely with this, so those platforms require a bit more work
(most notably the sparc) before they can use this new memory
arrangement.

This change also introduces a VM_DEFAULT_ADDRESS() macro that picks
the appropriate default address based on the size of the allocation or
the size of the process's text segment accordingly. Several drivers
and the SYSV SHM address assignment were changed to use this instead
of each one picking their own "default".

Add extensible malloc types, adapted from FreeBSD. This turns
malloc types into a structure, a pointer to which is passed around,
instead of an int constant. Allow the limit to be adjusted when the
malloc type is defined, or with a function call, as suggested by
Jonathan Stone.

Two small changes to the ELF exec code:

(1) ELFNAME(load_file)() now takes a pointer to the entry point
offset, instead of taking a pointer to the entry point itself. This
allows proper adjustment of the ultimate entry point at a higher level
if the object containing the entry point is moved before the exec is
finished.

(2) Introduce VMCMD_FIXED, which means the address at which a given
vmcmd describes a mapping is fixed (ie, should not be moved). Don't
set this for entries pertaining to ld.so.

Also some minor comment/whitespace tweaks.

Merge the nathanw_sa branch.

branches: 1.64.4;
Split off the backend of the shmat system call, and find removed segments
if requested. This enables the linux compat code to be bug compatible
(under Linux, shmat() to a removed segment works).

don't need <sys/types.h> when including <sys/param.h>

add RCSIDs

branches: 1.61.2; 1.61.6;
eliminate the KERN_* error codes in favor of the traditional E* codes.
the mapping is:

KERN_SUCCESS 0
KERN_INVALID_ADDRESS EFAULT
KERN_PROTECTION_FAILURE EACCES
KERN_NO_SPACE ENOMEM
KERN_INVALID_ARGUMENT EINVAL
KERN_FAILURE various, mostly turn into KASSERTs
KERN_RESOURCE_SHORTAGE ENOMEM
KERN_NOT_RECEIVER <unused>
KERN_NO_ACCESS <unused>
KERN_PAGES_LOCKED <unused>

branches: 1.60.2;
NBPG -> PAGE_SIZE

Add an align argument to uvm_map() and some callers of that
routine. Works similarly fto pmap_prefer(), but allows callers
to specify a minimum power-of-two alignment of the region.
How we ever got along without this for so long is beyond me.

Delete a couple of <uvm/uvm_extern.h> includes that were for
<sys/sysctl.h> only.

remove include of <vm/vm.h>

branches: 1.56.2;
Add new sysctl node "KERN_SYSVIPC_INFO" with "KERN_SYSVIPC_MSG_INFO",
"KERN_SYSVIPC_SEM_INFO" and "KERN_SYSVIPC_SHM_INFO" to return the
info and data structures for the relevent SysV IPC types. The return
structures use fixed-size types and should be compat32 safe. All
user-visible changes are protected with
#if !defined(_POSIX_C_SOURCE) && !defined(_XOPEN_SOURCE)

Make all variable declarations extern in msg.h, sem.h and shm.h and
add relevent variable declarations to sysv_*.c and remove unneeded
header files from those .c files.

Make compat14 SysV IPC conversion functions and sysctl_file() static.

Change the data pointer to "void *" in sysctl_clockrate(),
sysctl_ntptime(), sysctl_file() and sysctl_doeproc().

branches: 1.55.2;
Remove shmsegs declaration from conf/param.c - it doesn't belong here.
Instead, put it in kern/sysv_shm.c.

Merge parts of chs-ubc2 into the trunk:
* Remove the casts to vaddr_t from the round_page() and trunc_page() macros to
make them type-generic, which is necessary i.e. to operate on file offsets
without truncating them.
* In due course, cast pointer arguments to these macros to an appropriate
integral type (paddr_t, vaddr_t).

Originally done by Chuck Silvers, updated by myself.

First round of discarding the CL* macros.

branches: 1.52.2; 1.52.8;
Overhaul of the SVID IPC facilities, primarily to use the types specified
by the Single UNIX Specification version 2, rather than the SVR2-derived
types. While I was here, I did a namespace sweep to expose the constants
and strucutures, and structure members described by SUSv2; documentation
updates coming shortly.

Fixes kern/8158.

branches: 1.51.4;
completely remove Mach VM support. all that is left is the all the
header files as UVM still uses (most of) these.

No need to get definition of "SYSV..." from "opt_sysv.h" because they
must be set if these files are compiled.

Defopt SYSVMSG, SYSVSEM and SYSVSHM.

Make copyright notices with my name consistent.

Merge paddr_t changes into the main branch.

Abolition of bcopy, ovbcopy, bcmp, and bzero, phase one.
bcopy(x, y, z) -> memcpy(y, x, z)
ovbcopy(x, y, z) -> memmove(y, x, z)
bcmp(x, y, z) -> memcmp(x, y, z)
bzero(x, y) -> memset(x, 0, y)

branches: 1.45.2;
uvm_deallocate() takes an address and a size, not an address range. From
ITOH Yasufumi <yasufu-i@is.aist-nara.ac.jp>, PR #5834.

Various SysV IPC prototype changes.

- add defopt's for UVM, UVMHIST and PMAP_NEW.
- remove unnecessary UVMHIST_DECL's.

initial import of the new virtual memory system, UVM, into -current.

UVM was written by chuck cranor <chuck@maria.wustl.edu>, with some
minor portions derived from the old Mach code. i provided some help
getting swap and paging working, and other bug fixes/ideas. chuck
silvers <chuq@chuq.com> also provided some other fixes.

this is the rest of the MI portion changes.

this will be KNF'd shortly. :-)

Make shmexit() and shmfork() take struct vmspace *'s, not struct proc *'s,
and update internal interfaces appropriately.

Fix error handling - call wakeup() in error case too.

Use a swap pager backed VM object for sysV shm instead of kernel VM.
Mostly from FreeBSD.

branches: 1.38.10;
Calling shmdt(2) before calling shmat(2) would crash the system because
p->p_vmspace->vm_shm would be NULL. Protected the rest of the cases where
that might happen too. This was the reason why sunxdoom would panic the
system in SVR4 emulation.

branches: 1.37.4;
Fix printf() formats.

More proto fixes

First pass at prototyping

Remove unused third arg to shmfork().

Prefix names of system call implementation functions with `sys_'.

Make system calls conform to a standard prototype and bring those
prototypes into scope.

try to insure that the 'default' address for shm segments is the same
from process to process. It apparently is on SysV systems, and some
programs depend on this. Suggested by John Birrell <jb@werple.mira.net.au>.

Extracted all of the compat_xxx routines, and created a library [libcompat]
for them. There are a few #ifdef COMPAT_XX remaining, but they are not easy
or worth eliminating (yet).

We need some compat_10 routines if COMPAT_SUNOS is on (PR #1008).

tty_tb.c: need to include ioctl_compat.h in order to compile.
sysv_shm.c: make shm_find_segment_by_shmid global so it can be used by
COMPAT_HPUX. There should be a better way...
rest: Add #ifdef COMPAT_HPUX where needed

kill the #if 0 around SHM_*LOCK. makes no difference, though...

update for new syscall args description mechanism

Decrease shm_nused when a segment is deleted.

initialize shmmax to `# of pages' at compile time; multiply by NBPG at
boot time (in shminit). This supports architecture families with varying
values for NBPG, and does not break ipcs.

branches: 1.23.2;
returning a gift

New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

shm map is pageable.

Use the same algorithm as mmap() with MAP_ANON for placing the segment.

Get rid of unneeded bzero().

sane initialization. fix bug kern/274

Update copyright.

If we try to create a key that's already being created, wait.

And finally, some optimization.

Fix this up some more. (I just read SVID again.)

Generalize ipcperm() a little.

Clean this up a bit, and fix several bugs.

sysv_shm.c from Adam.
sysv_ipc.c from me.
and various sundry changes to make sysv_ipc.c fit in.
(somewhat untested and not very pleasant reading material)

SHM_LOCK and SHM_UNLOCK aren't just HPUXCOMPAT

#include vm_user.h.

Canonicalize all #includes.

Add the System V message queue and semaphore facilities. Implemented
by Daniel Boulet <danny@BouletFermat.ab.ca>

branches: 1.6.2;
Add RCS identifiers (this time on the correct side of the branch), and
incorporate recent changes in netbsd-0-9 branch.

Finish moving struct definitions outside of function declarations.

shminit has void return type.

add $Id$ strings, and clean up file headers where necessary

From: Guido van Rooij <guido@gvr.win.tue.nl>

when mmapping a file, permissions are checked as it should be. When
mprotect()-ing the address range afterwards, no protection was checked
regarding the protection of the file originally opened. So
when you open /usr/bin/su RDONLY and SHARED you could afterwards change
the mmapped region to READ|WRITE. This gave the possibility to obtain
root privs obviously.

branches: 1.1.1;
Initial revision

simpler fix for the race between shmat() and shmdt():
change shmat() to hold shm_lock until it is completely done.

revert rev 1.139 (fixing a race between shmat() and shmdt())
that approach turned out to be too complicated.

in shmdt(), wait until shmat() completes before detaching.

Reported-by: syzbot+8f470a1bf36b47ae0040@syzkaller.appspotmail.com
Reported-by: syzbot+45810b4c41ed65d9148d@syzkaller.appspotmail.com

Fix stupid bugs in linux_sys_shmctl(): the index could be out of bound
(page fault) and there was no proper locking.

Maybe we should just remove LINUX_SHM_STAT, like compat_linux32.

Many years ago someone created a new __link_set_sysctl_funcs to hold
the list of routines that need to be called for setting up sysctl
variables. This worked great for all code included in the kernel
itself, but didn't deal with modules that want to create their own
sysctl data. So, we ended up with a lot of #ifdef _MODULE blocks
so modules could explicitly call their setup functions when loaded
as non-built-in modules.

So today, we complete the task that was started so many years ago.

When modules are loaded, after we've called xxx_modcmd(INIT...) we
check if the module contains its own __link_set_sysctl_funcs, and
if so we call the functions listed. We add a struct sysctllog member
to the struct module so we can call sysctl_teardown() when the module
gets unloaded. (The sequence of events ensures that the sysctl stuff
doesn't get created until the rest of the module's init code does any
required memory allocation.)

So, no more need to explicitly call the sysctl setup routines when
built as a loadable module.

Acquire shmseg uobj reference while we hold shm_lock.

Otherwise nothing prevents it from being detached under our feet when
we drop shm_lock.

Reported-by: syzbot+a76c618a6808a0fda475@syzkaller.appspotmail.com

branches: 1.135.2;
shmctl(SHM_LOCK) does not need to mess with mappings of the shm segment,
uvm_obj_wirepages() is sufficient. this fixes the problem reported in
https://syzkaller.appspot.com/bug?id=71f9271d761f5b6ed517a18030dc04f0135e6179

Replace some "panic()" calls with simple "printf() ; return error"

There's no good reason for these build-time parameters to be allowed to
panic the kernel when it is easy to simply disable the module code and
fail gracefully.

While we're at it, similarly replace panic() when malloc fails to also
fail gracefully.

for sysv ipc stat operations, explicitly copy the exported parts
instead of the whole ds structure.

besides triggering a recently added assert in netbsd32, this stops
exposing kernel addresses.

copy the mode clamping to 0777 from sem to shm and msg.


while here, make sure that the compat callers to sysv_ipc clear
the contents of the compat structure before setting the result
members to ensure padding bytes are cleared.

don't set/copy _sem_base, _msg_first, _msg_last or _shm_internal.
even if used, which seems very dodgy, they leak KVAs as well.
possibly this may affect linux binaries, in particular, the
comments around _shm_internal ("XXX Oh well.") may mean apps
rely upon these but hopefully not -- the comments date back to
rev 1.1 in 1995.

the _key, _seq and _msg_cbytes members are exported as before as
i found multiple consumers of these (no less than ipcs(1), and
they appear to be useful for debugging and more.


XXX: the naming of compat functions have too many styles. there
are at least 3 different ones changed here.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.131.10; 1.131.16; 1.131.18;
We never exec(2) with a kernel vmspace, so do not test for that, but instead
KASSERT() that we don't.
When calculating the load address for the interpreter (e.g. ld.elf_so),
we need to take into account wether the exec'd process will run with
topdown memory or bottom up. We can not use the current vmspace's flags
to test for that, as this happens too early. Luckily the execpack already
knows what the new state will be later, so instead of testing the current
vmspace, pass the info as additional argument to struct emul
e_vm_default_addr.
Fix all such functions and adopt all callers.

In sysv_sem.c, defer establishment of exithook so we can initialize the
module code from module_init() rather than waiting until after calling
exec_init(). Use a RUN_ONCE routine at entry to each sys_sem* syscall
to establish the exithook, and no longer KASSERT that the hook has
been set before removing it. (A manually loaded module can be unloaded
before any syscalls have been invoked.)

Remove the conditional calls to the various xxx_init() routines from
init_main.c - we now rely on module_init() to handle initialization.

Let each sub-component's xxx_init() routine handle its own sysctl
sub-tree initialization; this removes another set of #ifdef ugliness.

Tested both built-in and loadable versions and verified that atf
test kernel/t_sysv passes.

Now that SYSVSHM is modularized, reattach the linkages from uvm so that
we can correctly clean up on process exit or fork.

Without this, firefox attaches to a shared memory segment but doesn't
detach before exit. Thus once firefox causes an autoload for sysv_ipc
it cannot be unloaded since the segment still retains references.

More prep: add a xxxfini() routine to each subcomponent so we can
clean up after ourselves. Mostly, this checks to make sure that
there are no active itmes, and then deallocates wired kernel virtual
memory. For SYSVSEM, we also disestablish the exithook() so we
won't try to call it after destroying its memory pool!

More preparation for modularizing the SYSVxxx options. Here we
change the kern.ipc.sysvxxx sysctls into dynamic values, so each
sub-component of SYSVxxx can declare its own availability.

In preparation for modularization of the SYSV* options, restore the
use of opt_sysv.h to get the -DSYSVxxx definitions.

branches: 1.125.2; 1.125.4; 1.125.6; 1.125.10;
In shmrealloc(), add missing condvar initialisations for segments
copied from previous location.

branches: 1.124.2;
Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

branches: 1.123.2; 1.123.4;
Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

branches: 1.122.2; 1.122.6;
Add an optional pglist argument to uvm_obj_wirepages, to be
filled with the list of pages that were wired.

Correct sizes to pass uvm_km_free(9) in error paths.

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.119.2;
- Replace shmmap_entry_pool with kmem(9), as pool is not worth.
- Sprinkle __cacheline_aligned and __read_mostly.

branches: 1.118.2;
Use 'z' printf format modifier to print size_t in debug code.

branches: 1.117.2; 1.117.4;
shmexit: simplify a lot by avoiding unnecessary memory allocations, since
it is a last reference, just re-lock and check mapping list again. Often
there wont be re-locks at all, moreover, shm_lock is not contended at all.

Remove SHMMAXPGS from all kernel configs. Dynamically compute the
initial limit as 1/4 of the physical memory. Ensure the limit is at
least 1024 pages, the old default on most platforms.

branches: 1.115.2;
merge christos-time_t

sys_shmat: initialise shmid of shmmap entry earlier. Now error path,
i.e. shm_delete_mapping, wont use random value.

branches: 1.113.2;
Change the order of error checks in shmget so EEXIST is returned before
EINVAL or EACCESS so callers have a more reliable way to tell if a
shared memory segment already exists.

branches: 1.112.2;
- Allow changing of kern.ipc.shmmax, just to avoid confusion.
- Change type of kern.ipc.shmmax to CTLTYPE_QUAD.

Fix the aligning of memory blocks again, finally...
Tested by <martin> on his sparc64 box.

branches: 1.110.4;
shmrealloc: destroy condition variables before freeing them.

sys_shmget: use the correct size variable for uobj_wirepages().
Adjust shm_memlock() for consistency too.

Fixes PR/38782, reported by Adam Hoka.

sys_shmget: fix an object leak in case of error.

branches: 1.107.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.106.2; 1.106.4;
Fix shared memory code that it could handle > 4GB addresses correctly.
PR/38109, patch (a little bit modified) from Chris Brand.

branches: 1.105.6; 1.105.8;
Fix shm_cv/newshm_cv offset value by using the correct sizeof argument
(kcondvar_t -> struct shmid_ds).

ok by rmind@

- sys_shmget: size type must be size_t, not int. Should avoid possible
problems with huge allocations.
- shmrealloc: use newshmni for calculation of new sz, shminfo.shmmni
was a mistake. Convert sz to size_t type.

Patch up sysctl locking:

- Lock processes, credentials, filehead etc correctly.
- Acquire a read hold on sysctl_treelock if only doing a query.
- Don't wire down the output buffer. It doesn't work correctly and the code
regularly does long term sleeps with it held - it's not worth it.
- Don't hold locks other than sysctl_lock while doing copyout().
- Drop sysctl_lock while doing copyout / allocating memory in a few places.
- Don't take kernel_lock for sysctl.
- Fix a number of bugs spotted along the way

Merge vmlocking2 to head.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.100.8; 1.100.14; 1.100.16; 1.100.20;
fix typos

branches: 1.99.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.98.2;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

TRUE -> true, FALSE -> false

branches: 1.96.2;
Replace some uses of lockmgr() / simplelocks.

Merge newlock2 to head.

PR/28458: shmat(2) shmaddr argument is not honored as intended.
Patch applied, thanks for Minoura Makoto.

Please note, that one should fail if cannot attach to shmaddr,
but not attach it to other place.

OK by uwe@

Avoid sleeping with a held simple_lock.

PR/34837: Mindaguas: Add SysV SHM dynamic reallocation and locking to the
physical memory

remove some __unused from function parameters.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.89.4; 1.89.6;
Use the LWP cached credentials where sane.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.87.2;
integrate kauth.

branches: 1.86.4; 1.86.6; 1.86.8; 1.86.10; 1.86.12;
Use ANSI function delcs.

fix debugging; remove some defines that are now in the header file.

branches: 1.84.2;
merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

Fix some things regarding COMPAT_NETBSD32 and limits/VM addresses.

* For sparc64 and amd64, define *SIZ32 VM constants.
* Add a new function pointer to struct emul, pointing at a function
that will return the default VM map address. The default function
is uvm_map_defaultaddr, which just uses the VM_DEFAULT_ADDRESS
macro. This gives emulations control over the default map address,
and allows things to be mapped at the right address (in 32bit range)
for COMPAT_NETBSD32.
* Add code to adjust the data and stack limits when a COMPAT_NETBSD32
or COMPAT_SVR4_32 binary is executed.
* Don't use USRSTACK in kern_resource.c, use p_vmspace->vm_minsaddr
instead (emulations might have set it differently)
* Since this changes struct emul, bump kernel version to 3.99.2

Tested on amd64, compile-tested on sparc64.

branches: 1.82.4; 1.82.6; 1.82.10;
fix typo (missing &)

use nointr allocator for shmmap_entry_pool - this is always accessed
from process context

kill the indirection via struct shm_handle and store pointer to the uvm
object direct to _shm_private; the indirection doesn't serve any
useful purpose and just wastes memory and cpu cycles

add flag for shmget(2) to specify that later shmat(2) for the shared memory
segment should succeed even if the segment would be marked removed; use this
to implement the Linux-compatible semantics of shmat(2)

this fixes the old Linux VMware3 graphics problem with local display,
and possibly other local Linux X clients using MIT-SHM

fold shmat1() back into sys_shmat(), the change in rev 1.64 is not sufficient
for Linux-compatible shmat() behaviour - shmat() for the removed shared memory
segment must work from all callers, the shared memory id could be passed e.g.
to native X server via MIT-SHM

temporarily remove the functionality, the Linux-compatible semantics
will be reimplemented differently

Initialise (most) pools from a link set instead of explicit calls
to pool_init. Untouched pools are ones that either in arch-specific
code, or aren't initialiased during initial system startup.

Convert struct session, ucred and lockf to pools.

branches: 1.76.2;
- Nuke __P().
- Drop trailing spaces.

include <uvm/uvm_object.h> for the benefit of ports that don't include
it in <machine/pmap.h>

- Don't use uao_ functions directly; use them through the pgops methods.
- Fix missing reference leak in the error path of shmat() mentioned in
Full-Disclosure.

Wrap long line.

add #ifdef DEBUG segnum sanity check in shm_delete_mapping()

allocate virtual memory for SYSV shm, msg and semaphore structures
separately from the bufpages, so that it would be possible to eventually
make their limits changeable in runtime

make static all local variables which do not need to be exported to other
kernel parts

Fix the "COW" case if a process does a detach() between fork()
and exit(): we have to lookup the entry in the private copy
again, otherwise the wrong list is manipulated.
should fix a panic on postgres shutdown reported by Marc Recht

being here, improve sone debug messages

Make per-process shm segment descriptor magement scale better for large
shminfo.shmseg, in view of the fact that only few processes utilize a
significant fraction of it:
-turn the table into a linked list, elements allocated from a pool(9)
-On fork(), just bump a refcount instead of copying the list; it will
be decremented on exit() and exec(). Only copy if an attach or detach
takes place in between, which is rarely the case.

branches: 1.68.2;
Introduce "top down" memory management for mmap()ed allocations. This
means that the dynamic linker gets mapped in at the top of available
user virtual memory (typically just below the stack), shared libraries
get mapped downwards from that point, and calls to mmap() that don't
specify a preferred address will get mapped in below those.

This means that the heap and the mmap()ed allocations will grow
towards each other, allowing one or the other to grow larger than
before. Previously, the heap was limited to MAXDSIZ by the placement
of the dynamic linker (and the process's rlimits) and the space
available to mmap was hobbled by this reservation.

This is currently only enabled via an *option* for the i386 platform
(though other platforms are expected to follow). Add "options
USE_TOPDOWN_VM" to your kernel config file, rerun config, and rebuild
your kernel to take advantage of this.

Note that the pmap_prefer() interface has not yet been modified to
play nicely with this, so those platforms require a bit more work
(most notably the sparc) before they can use this new memory
arrangement.

This change also introduces a VM_DEFAULT_ADDRESS() macro that picks
the appropriate default address based on the size of the allocation or
the size of the process's text segment accordingly. Several drivers
and the SYSV SHM address assignment were changed to use this instead
of each one picking their own "default".

Add extensible malloc types, adapted from FreeBSD. This turns
malloc types into a structure, a pointer to which is passed around,
instead of an int constant. Allow the limit to be adjusted when the
malloc type is defined, or with a function call, as suggested by
Jonathan Stone.

Two small changes to the ELF exec code:

(1) ELFNAME(load_file)() now takes a pointer to the entry point
offset, instead of taking a pointer to the entry point itself. This
allows proper adjustment of the ultimate entry point at a higher level
if the object containing the entry point is moved before the exec is
finished.

(2) Introduce VMCMD_FIXED, which means the address at which a given
vmcmd describes a mapping is fixed (ie, should not be moved). Don't
set this for entries pertaining to ld.so.

Also some minor comment/whitespace tweaks.

Merge the nathanw_sa branch.

branches: 1.64.4;
Split off the backend of the shmat system call, and find removed segments
if requested. This enables the linux compat code to be bug compatible
(under Linux, shmat() to a removed segment works).

don't need <sys/types.h> when including <sys/param.h>

add RCSIDs

branches: 1.61.2; 1.61.6;
eliminate the KERN_* error codes in favor of the traditional E* codes.
the mapping is:

KERN_SUCCESS 0
KERN_INVALID_ADDRESS EFAULT
KERN_PROTECTION_FAILURE EACCES
KERN_NO_SPACE ENOMEM
KERN_INVALID_ARGUMENT EINVAL
KERN_FAILURE various, mostly turn into KASSERTs
KERN_RESOURCE_SHORTAGE ENOMEM
KERN_NOT_RECEIVER <unused>
KERN_NO_ACCESS <unused>
KERN_PAGES_LOCKED <unused>

branches: 1.60.2;
NBPG -> PAGE_SIZE

Add an align argument to uvm_map() and some callers of that
routine. Works similarly fto pmap_prefer(), but allows callers
to specify a minimum power-of-two alignment of the region.
How we ever got along without this for so long is beyond me.

Delete a couple of <uvm/uvm_extern.h> includes that were for
<sys/sysctl.h> only.

remove include of <vm/vm.h>

branches: 1.56.2;
Add new sysctl node "KERN_SYSVIPC_INFO" with "KERN_SYSVIPC_MSG_INFO",
"KERN_SYSVIPC_SEM_INFO" and "KERN_SYSVIPC_SHM_INFO" to return the
info and data structures for the relevent SysV IPC types. The return
structures use fixed-size types and should be compat32 safe. All
user-visible changes are protected with
#if !defined(_POSIX_C_SOURCE) && !defined(_XOPEN_SOURCE)

Make all variable declarations extern in msg.h, sem.h and shm.h and
add relevent variable declarations to sysv_*.c and remove unneeded
header files from those .c files.

Make compat14 SysV IPC conversion functions and sysctl_file() static.

Change the data pointer to "void *" in sysctl_clockrate(),
sysctl_ntptime(), sysctl_file() and sysctl_doeproc().

branches: 1.55.2;
Remove shmsegs declaration from conf/param.c - it doesn't belong here.
Instead, put it in kern/sysv_shm.c.

Merge parts of chs-ubc2 into the trunk:
* Remove the casts to vaddr_t from the round_page() and trunc_page() macros to
make them type-generic, which is necessary i.e. to operate on file offsets
without truncating them.
* In due course, cast pointer arguments to these macros to an appropriate
integral type (paddr_t, vaddr_t).

Originally done by Chuck Silvers, updated by myself.

First round of discarding the CL* macros.

branches: 1.52.2; 1.52.8;
Overhaul of the SVID IPC facilities, primarily to use the types specified
by the Single UNIX Specification version 2, rather than the SVR2-derived
types. While I was here, I did a namespace sweep to expose the constants
and strucutures, and structure members described by SUSv2; documentation
updates coming shortly.

Fixes kern/8158.

branches: 1.51.4;
completely remove Mach VM support. all that is left is the all the
header files as UVM still uses (most of) these.

No need to get definition of "SYSV..." from "opt_sysv.h" because they
must be set if these files are compiled.

Defopt SYSVMSG, SYSVSEM and SYSVSHM.

Make copyright notices with my name consistent.

Merge paddr_t changes into the main branch.

Abolition of bcopy, ovbcopy, bcmp, and bzero, phase one.
bcopy(x, y, z) -> memcpy(y, x, z)
ovbcopy(x, y, z) -> memmove(y, x, z)
bcmp(x, y, z) -> memcmp(x, y, z)
bzero(x, y) -> memset(x, 0, y)

branches: 1.45.2;
uvm_deallocate() takes an address and a size, not an address range. From
ITOH Yasufumi <yasufu-i@is.aist-nara.ac.jp>, PR #5834.

Various SysV IPC prototype changes.

- add defopt's for UVM, UVMHIST and PMAP_NEW.
- remove unnecessary UVMHIST_DECL's.

initial import of the new virtual memory system, UVM, into -current.

UVM was written by chuck cranor <chuck@maria.wustl.edu>, with some
minor portions derived from the old Mach code. i provided some help
getting swap and paging working, and other bug fixes/ideas. chuck
silvers <chuq@chuq.com> also provided some other fixes.

this is the rest of the MI portion changes.

this will be KNF'd shortly. :-)

Make shmexit() and shmfork() take struct vmspace *'s, not struct proc *'s,
and update internal interfaces appropriately.

Fix error handling - call wakeup() in error case too.

Use a swap pager backed VM object for sysV shm instead of kernel VM.
Mostly from FreeBSD.

branches: 1.38.10;
Calling shmdt(2) before calling shmat(2) would crash the system because
p->p_vmspace->vm_shm would be NULL. Protected the rest of the cases where
that might happen too. This was the reason why sunxdoom would panic the
system in SVR4 emulation.

branches: 1.37.4;
Fix printf() formats.

More proto fixes

First pass at prototyping

Remove unused third arg to shmfork().

Prefix names of system call implementation functions with `sys_'.

Make system calls conform to a standard prototype and bring those
prototypes into scope.

try to insure that the 'default' address for shm segments is the same
from process to process. It apparently is on SysV systems, and some
programs depend on this. Suggested by John Birrell <jb@werple.mira.net.au>.

Extracted all of the compat_xxx routines, and created a library [libcompat]
for them. There are a few #ifdef COMPAT_XX remaining, but they are not easy
or worth eliminating (yet).

We need some compat_10 routines if COMPAT_SUNOS is on (PR #1008).

tty_tb.c: need to include ioctl_compat.h in order to compile.
sysv_shm.c: make shm_find_segment_by_shmid global so it can be used by
COMPAT_HPUX. There should be a better way...
rest: Add #ifdef COMPAT_HPUX where needed

kill the #if 0 around SHM_*LOCK. makes no difference, though...

update for new syscall args description mechanism

Decrease shm_nused when a segment is deleted.

initialize shmmax to `# of pages' at compile time; multiply by NBPG at
boot time (in shminit). This supports architecture families with varying
values for NBPG, and does not break ipcs.

branches: 1.23.2;
returning a gift

New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

shm map is pageable.

Use the same algorithm as mmap() with MAP_ANON for placing the segment.

Get rid of unneeded bzero().

sane initialization. fix bug kern/274

Update copyright.

If we try to create a key that's already being created, wait.

And finally, some optimization.

Fix this up some more. (I just read SVID again.)

Generalize ipcperm() a little.

Clean this up a bit, and fix several bugs.

sysv_shm.c from Adam.
sysv_ipc.c from me.
and various sundry changes to make sysv_ipc.c fit in.
(somewhat untested and not very pleasant reading material)

SHM_LOCK and SHM_UNLOCK aren't just HPUXCOMPAT

#include vm_user.h.

Canonicalize all #includes.

Add the System V message queue and semaphore facilities. Implemented
by Daniel Boulet <danny@BouletFermat.ab.ca>

branches: 1.6.2;
Add RCS identifiers (this time on the correct side of the branch), and
incorporate recent changes in netbsd-0-9 branch.

Finish moving struct definitions outside of function declarations.

shminit has void return type.

add $Id$ strings, and clean up file headers where necessary

From: Guido van Rooij <guido@gvr.win.tue.nl>

when mmapping a file, permissions are checked as it should be. When
mprotect()-ing the address range afterwards, no protection was checked
regarding the protection of the file originally opened. So
when you open /usr/bin/su RDONLY and SHARED you could afterwards change
the mmapped region to READ|WRITE. This gave the possibility to obtain
root privs obviously.

branches: 1.1.1;
Initial revision

in shmdt(), wait until shmat() completes before detaching.

Reported-by: syzbot+8f470a1bf36b47ae0040@syzkaller.appspotmail.com
Reported-by: syzbot+45810b4c41ed65d9148d@syzkaller.appspotmail.com

Fix stupid bugs in linux_sys_shmctl(): the index could be out of bound
(page fault) and there was no proper locking.

Maybe we should just remove LINUX_SHM_STAT, like compat_linux32.

Many years ago someone created a new __link_set_sysctl_funcs to hold
the list of routines that need to be called for setting up sysctl
variables. This worked great for all code included in the kernel
itself, but didn't deal with modules that want to create their own
sysctl data. So, we ended up with a lot of #ifdef _MODULE blocks
so modules could explicitly call their setup functions when loaded
as non-built-in modules.

So today, we complete the task that was started so many years ago.

When modules are loaded, after we've called xxx_modcmd(INIT...) we
check if the module contains its own __link_set_sysctl_funcs, and
if so we call the functions listed. We add a struct sysctllog member
to the struct module so we can call sysctl_teardown() when the module
gets unloaded. (The sequence of events ensures that the sysctl stuff
doesn't get created until the rest of the module's init code does any
required memory allocation.)

So, no more need to explicitly call the sysctl setup routines when
built as a loadable module.

Acquire shmseg uobj reference while we hold shm_lock.

Otherwise nothing prevents it from being detached under our feet when
we drop shm_lock.

Reported-by: syzbot+a76c618a6808a0fda475@syzkaller.appspotmail.com

branches: 1.135.2;
shmctl(SHM_LOCK) does not need to mess with mappings of the shm segment,
uvm_obj_wirepages() is sufficient. this fixes the problem reported in
https://syzkaller.appspot.com/bug?id=71f9271d761f5b6ed517a18030dc04f0135e6179

Replace some "panic()" calls with simple "printf() ; return error"

There's no good reason for these build-time parameters to be allowed to
panic the kernel when it is easy to simply disable the module code and
fail gracefully.

While we're at it, similarly replace panic() when malloc fails to also
fail gracefully.

for sysv ipc stat operations, explicitly copy the exported parts
instead of the whole ds structure.

besides triggering a recently added assert in netbsd32, this stops
exposing kernel addresses.

copy the mode clamping to 0777 from sem to shm and msg.


while here, make sure that the compat callers to sysv_ipc clear
the contents of the compat structure before setting the result
members to ensure padding bytes are cleared.

don't set/copy _sem_base, _msg_first, _msg_last or _shm_internal.
even if used, which seems very dodgy, they leak KVAs as well.
possibly this may affect linux binaries, in particular, the
comments around _shm_internal ("XXX Oh well.") may mean apps
rely upon these but hopefully not -- the comments date back to
rev 1.1 in 1995.

the _key, _seq and _msg_cbytes members are exported as before as
i found multiple consumers of these (no less than ipcs(1), and
they appear to be useful for debugging and more.


XXX: the naming of compat functions have too many styles. there
are at least 3 different ones changed here.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int. The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER! Some subsystems have

#define min(a, b) ((a) < (b) ? (a) : (b))
#define max(a, b) ((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX. Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate. But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all. (Who knows, maybe in some cases integer
truncation is actually intended!)

branches: 1.131.10; 1.131.16; 1.131.18;
We never exec(2) with a kernel vmspace, so do not test for that, but instead
KASSERT() that we don't.
When calculating the load address for the interpreter (e.g. ld.elf_so),
we need to take into account wether the exec'd process will run with
topdown memory or bottom up. We can not use the current vmspace's flags
to test for that, as this happens too early. Luckily the execpack already
knows what the new state will be later, so instead of testing the current
vmspace, pass the info as additional argument to struct emul
e_vm_default_addr.
Fix all such functions and adopt all callers.

In sysv_sem.c, defer establishment of exithook so we can initialize the
module code from module_init() rather than waiting until after calling
exec_init(). Use a RUN_ONCE routine at entry to each sys_sem* syscall
to establish the exithook, and no longer KASSERT that the hook has
been set before removing it. (A manually loaded module can be unloaded
before any syscalls have been invoked.)

Remove the conditional calls to the various xxx_init() routines from
init_main.c - we now rely on module_init() to handle initialization.

Let each sub-component's xxx_init() routine handle its own sysctl
sub-tree initialization; this removes another set of #ifdef ugliness.

Tested both built-in and loadable versions and verified that atf
test kernel/t_sysv passes.

Now that SYSVSHM is modularized, reattach the linkages from uvm so that
we can correctly clean up on process exit or fork.

Without this, firefox attaches to a shared memory segment but doesn't
detach before exit. Thus once firefox causes an autoload for sysv_ipc
it cannot be unloaded since the segment still retains references.

More prep: add a xxxfini() routine to each subcomponent so we can
clean up after ourselves. Mostly, this checks to make sure that
there are no active itmes, and then deallocates wired kernel virtual
memory. For SYSVSEM, we also disestablish the exithook() so we
won't try to call it after destroying its memory pool!

More preparation for modularizing the SYSVxxx options. Here we
change the kern.ipc.sysvxxx sysctls into dynamic values, so each
sub-component of SYSVxxx can declare its own availability.

In preparation for modularization of the SYSV* options, restore the
use of opt_sysv.h to get the -DSYSVxxx definitions.

branches: 1.125.2; 1.125.4; 1.125.6; 1.125.10;
In shmrealloc(), add missing condvar initialisations for segments
copied from previous location.

branches: 1.124.2;
Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

branches: 1.123.2; 1.123.4;
Replace the remaining KAUTH_GENERIC_ISSUSER authorization calls with
something meaningful. All relevant documentation has been updated or
written.

Most of these changes were brought up in the following messages:

http://mail-index.netbsd.org/tech-kern/2012/01/18/msg012490.html
http://mail-index.netbsd.org/tech-kern/2012/01/19/msg012502.html
http://mail-index.netbsd.org/tech-kern/2012/02/17/msg012728.html

Thanks to christos, manu, njoly, and jmmv for input.

Huge thanks to pgoyette for spinning these changes through some build
cycles and ATF.

branches: 1.122.2; 1.122.6;
Add an optional pglist argument to uvm_obj_wirepages, to be
filled with the list of pages that were wired.

Correct sizes to pass uvm_km_free(9) in error paths.

Welcome to 5.99.53! Merge rmind-uvmplock branch:

- Reorganize locking in UVM and provide extra serialisation for pmap(9).
New lock order: [vmpage-owner-lock] -> pmap-lock.

- Simplify locking in some pmap(9) modules by removing P->V locking.

- Use lock object on vmobjlock (and thus vnode_t::v_interlock) to share
the locks amongst UVM objects where necessary (tmpfs, layerfs, unionfs).

- Rewrite and optimise x86 TLB shootdown code, make it simpler and cleaner.
Add TLBSTATS option for x86 to collect statistics about TLB shootdowns.

- Unify /dev/mem et al in MI code and provide required locking (removes
kernel-lock on some ports). Also, avoid cache-aliasing issues.

Thanks to Andrew Doran and Joerg Sonnenberger, as their initial patches
formed the core changes of this branch.

branches: 1.119.2;
- Replace shmmap_entry_pool with kmem(9), as pool is not worth.
- Sprinkle __cacheline_aligned and __read_mostly.

branches: 1.118.2;
Use 'z' printf format modifier to print size_t in debug code.

branches: 1.117.2; 1.117.4;
shmexit: simplify a lot by avoiding unnecessary memory allocations, since
it is a last reference, just re-lock and check mapping list again. Often
there wont be re-locks at all, moreover, shm_lock is not contended at all.

Remove SHMMAXPGS from all kernel configs. Dynamically compute the
initial limit as 1/4 of the physical memory. Ensure the limit is at
least 1024 pages, the old default on most platforms.

branches: 1.115.2;
merge christos-time_t

sys_shmat: initialise shmid of shmmap entry earlier. Now error path,
i.e. shm_delete_mapping, wont use random value.

branches: 1.113.2;
Change the order of error checks in shmget so EEXIST is returned before
EINVAL or EACCESS so callers have a more reliable way to tell if a
shared memory segment already exists.

branches: 1.112.2;
- Allow changing of kern.ipc.shmmax, just to avoid confusion.
- Change type of kern.ipc.shmmax to CTLTYPE_QUAD.

Fix the aligning of memory blocks again, finally...
Tested by <martin> on his sparc64 box.

branches: 1.110.4;
shmrealloc: destroy condition variables before freeing them.

sys_shmget: use the correct size variable for uobj_wirepages().
Adjust shm_memlock() for consistency too.

Fixes PR/38782, reported by Adam Hoka.

sys_shmget: fix an object leak in case of error.

branches: 1.107.2;
Remove clause 3 and 4 from TNF licenses

branches: 1.106.2; 1.106.4;
Fix shared memory code that it could handle > 4GB addresses correctly.
PR/38109, patch (a little bit modified) from Chris Brand.

branches: 1.105.6; 1.105.8;
Fix shm_cv/newshm_cv offset value by using the correct sizeof argument
(kcondvar_t -> struct shmid_ds).

ok by rmind@

- sys_shmget: size type must be size_t, not int. Should avoid possible
problems with huge allocations.
- shmrealloc: use newshmni for calculation of new sz, shminfo.shmmni
was a mistake. Convert sz to size_t type.

Patch up sysctl locking:

- Lock processes, credentials, filehead etc correctly.
- Acquire a read hold on sysctl_treelock if only doing a query.
- Don't wire down the output buffer. It doesn't work correctly and the code
regularly does long term sleeps with it held - it's not worth it.
- Don't hold locks other than sysctl_lock while doing copyout().
- Drop sysctl_lock while doing copyout / allocating memory in a few places.
- Don't take kernel_lock for sysctl.
- Fix a number of bugs spotted along the way

Merge vmlocking2 to head.

Convert all the system call entry points from:
int foo(struct lwp *l, void *v, register_t *retval)
to:
int foo(struct lwp *l, const struct foo_args *uap, register_t *retval)
Fixup compat code to not write into 'uap' and (in some cases) to actually
pass a correctly formatted 'uap' structure with the right name to the
next routine.
A few 'compat' routines that just call standard ones have been deleted.
All the 'compat' code compiles (along with the kernels required to test
build it).
98% done by automated scripts.

branches: 1.100.8; 1.100.14; 1.100.16; 1.100.20;
fix typos

branches: 1.99.2;
Pass an ipl argument to pool_init/POOL_INIT to be used when initializing
the pool's lock.

branches: 1.98.2;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

TRUE -> true, FALSE -> false

branches: 1.96.2;
Replace some uses of lockmgr() / simplelocks.

Merge newlock2 to head.

PR/28458: shmat(2) shmaddr argument is not honored as intended.
Patch applied, thanks for Minoura Makoto.

Please note, that one should fail if cannot attach to shmaddr,
but not attach it to other place.

OK by uwe@

Avoid sleeping with a held simple_lock.

PR/34837: Mindaguas: Add SysV SHM dynamic reallocation and locking to the
physical memory

remove some __unused from function parameters.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.89.4; 1.89.6;
Use the LWP cached credentials where sane.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.87.2;
integrate kauth.

branches: 1.86.4; 1.86.6; 1.86.8; 1.86.10; 1.86.12;
Use ANSI function delcs.

fix debugging; remove some defines that are now in the header file.

branches: 1.84.2;
merge yamt-km branch.
- don't use managed mappings/backing objects for wired memory allocations.
save some resources like pv_entry. also fix (most of) PR/27030.
- simplify kernel memory management API.
- simplify pmap bootstrap of some ports.
- some related cleanups.

Fix some things regarding COMPAT_NETBSD32 and limits/VM addresses.

* For sparc64 and amd64, define *SIZ32 VM constants.
* Add a new function pointer to struct emul, pointing at a function
that will return the default VM map address. The default function
is uvm_map_defaultaddr, which just uses the VM_DEFAULT_ADDRESS
macro. This gives emulations control over the default map address,
and allows things to be mapped at the right address (in 32bit range)
for COMPAT_NETBSD32.
* Add code to adjust the data and stack limits when a COMPAT_NETBSD32
or COMPAT_SVR4_32 binary is executed.
* Don't use USRSTACK in kern_resource.c, use p_vmspace->vm_minsaddr
instead (emulations might have set it differently)
* Since this changes struct emul, bump kernel version to 3.99.2

Tested on amd64, compile-tested on sparc64.

branches: 1.82.4; 1.82.6; 1.82.10;
fix typo (missing &)

use nointr allocator for shmmap_entry_pool - this is always accessed
from process context

kill the indirection via struct shm_handle and store pointer to the uvm
object direct to _shm_private; the indirection doesn't serve any
useful purpose and just wastes memory and cpu cycles

add flag for shmget(2) to specify that later shmat(2) for the shared memory
segment should succeed even if the segment would be marked removed; use this
to implement the Linux-compatible semantics of shmat(2)

this fixes the old Linux VMware3 graphics problem with local display,
and possibly other local Linux X clients using MIT-SHM

fold shmat1() back into sys_shmat(), the change in rev 1.64 is not sufficient
for Linux-compatible shmat() behaviour - shmat() for the removed shared memory
segment must work from all callers, the shared memory id could be passed e.g.
to native X server via MIT-SHM

temporarily remove the functionality, the Linux-compatible semantics
will be reimplemented differently

Initialise (most) pools from a link set instead of explicit calls
to pool_init. Untouched pools are ones that either in arch-specific
code, or aren't initialiased during initial system startup.

Convert struct session, ucred and lockf to pools.

branches: 1.76.2;
- Nuke __P().
- Drop trailing spaces.

include <uvm/uvm_object.h> for the benefit of ports that don't include
it in <machine/pmap.h>

- Don't use uao_ functions directly; use them through the pgops methods.
- Fix missing reference leak in the error path of shmat() mentioned in
Full-Disclosure.

Wrap long line.

add #ifdef DEBUG segnum sanity check in shm_delete_mapping()

allocate virtual memory for SYSV shm, msg and semaphore structures
separately from the bufpages, so that it would be possible to eventually
make their limits changeable in runtime

make static all local variables which do not need to be exported to other
kernel parts

Fix the "COW" case if a process does a detach() between fork()
and exit(): we have to lookup the entry in the private copy
again, otherwise the wrong list is manipulated.
should fix a panic on postgres shutdown reported by Marc Recht

being here, improve sone debug messages

Make per-process shm segment descriptor magement scale better for large
shminfo.shmseg, in view of the fact that only few processes utilize a
significant fraction of it:
-turn the table into a linked list, elements allocated from a pool(9)
-On fork(), just bump a refcount instead of copying the list; it will
be decremented on exit() and exec(). Only copy if an attach or detach
takes place in between, which is rarely the case.

branches: 1.68.2;
Introduce "top down" memory management for mmap()ed allocations. This
means that the dynamic linker gets mapped in at the top of available
user virtual memory (typically just below the stack), shared libraries
get mapped downwards from that point, and calls to mmap() that don't
specify a preferred address will get mapped in below those.

This means that the heap and the mmap()ed allocations will grow
towards each other, allowing one or the other to grow larger than
before. Previously, the heap was limited to MAXDSIZ by the placement
of the dynamic linker (and the process's rlimits) and the space
available to mmap was hobbled by this reservation.

This is currently only enabled via an *option* for the i386 platform
(though other platforms are expected to follow). Add "options
USE_TOPDOWN_VM" to your kernel config file, rerun config, and rebuild
your kernel to take advantage of this.

Note that the pmap_prefer() interface has not yet been modified to
play nicely with this, so those platforms require a bit more work
(most notably the sparc) before they can use this new memory
arrangement.

This change also introduces a VM_DEFAULT_ADDRESS() macro that picks
the appropriate default address based on the size of the allocation or
the size of the process's text segment accordingly. Several drivers
and the SYSV SHM address assignment were changed to use this instead
of each one picking their own "default".

Add extensible malloc types, adapted from FreeBSD. This turns
malloc types into a structure, a pointer to which is passed around,
instead of an int constant. Allow the limit to be adjusted when the
malloc type is defined, or with a function call, as suggested by
Jonathan Stone.

Two small changes to the ELF exec code:

(1) ELFNAME(load_file)() now takes a pointer to the entry point
offset, instead of taking a pointer to the entry point itself. This
allows proper adjustment of the ultimate entry point at a higher level
if the object containing the entry point is moved before the exec is
finished.

(2) Introduce VMCMD_FIXED, which means the address at which a given
vmcmd describes a mapping is fixed (ie, should not be moved). Don't
set this for entries pertaining to ld.so.

Also some minor comment/whitespace tweaks.

Merge the nathanw_sa branch.

branches: 1.64.4;
Split off the backend of the shmat system call, and find removed segments
if requested. This enables the linux compat code to be bug compatible
(under Linux, shmat() to a removed segment works).

don't need <sys/types.h> when including <sys/param.h>

add RCSIDs

branches: 1.61.2; 1.61.6;
eliminate the KERN_* error codes in favor of the traditional E* codes.
the mapping is:

KERN_SUCCESS 0
KERN_INVALID_ADDRESS EFAULT
KERN_PROTECTION_FAILURE EACCES
KERN_NO_SPACE ENOMEM
KERN_INVALID_ARGUMENT EINVAL
KERN_FAILURE various, mostly turn into KASSERTs
KERN_RESOURCE_SHORTAGE ENOMEM
KERN_NOT_RECEIVER <unused>
KERN_NO_ACCESS <unused>
KERN_PAGES_LOCKED <unused>

branches: 1.60.2;
NBPG -> PAGE_SIZE

Add an align argument to uvm_map() and some callers of that
routine. Works similarly fto pmap_prefer(), but allows callers
to specify a minimum power-of-two alignment of the region.
How we ever got along without this for so long is beyond me.

Delete a couple of <uvm/uvm_extern.h> includes that were for
<sys/sysctl.h> only.

remove include of <vm/vm.h>

branches: 1.56.2;
Add new sysctl node "KERN_SYSVIPC_INFO" with "KERN_SYSVIPC_MSG_INFO",
"KERN_SYSVIPC_SEM_INFO" and "KERN_SYSVIPC_SHM_INFO" to return the
info and data structures for the relevent SysV IPC types. The return
structures use fixed-size types and should be compat32 safe. All
user-visible changes are protected with
#if !defined(_POSIX_C_SOURCE) && !defined(_XOPEN_SOURCE)

Make all variable declarations extern in msg.h, sem.h and shm.h and
add relevent variable declarations to sysv_*.c and remove unneeded
header files from those .c files.

Make compat14 SysV IPC conversion functions and sysctl_file() static.

Change the data pointer to "void *" in sysctl_clockrate(),
sysctl_ntptime(), sysctl_file() and sysctl_doeproc().

branches: 1.55.2;
Remove shmsegs declaration from conf/param.c - it doesn't belong here.
Instead, put it in kern/sysv_shm.c.

Merge parts of chs-ubc2 into the trunk:
* Remove the casts to vaddr_t from the round_page() and trunc_page() macros to
make them type-generic, which is necessary i.e. to operate on file offsets
without truncating them.
* In due course, cast pointer arguments to these macros to an appropriate
integral type (paddr_t, vaddr_t).

Originally done by Chuck Silvers, updated by myself.

First round of discarding the CL* macros.

branches: 1.52.2; 1.52.8;
Overhaul of the SVID IPC facilities, primarily to use the types specified
by the Single UNIX Specification version 2, rather than the SVR2-derived
types. While I was here, I did a namespace sweep to expose the constants
and strucutures, and structure members described by SUSv2; documentation
updates coming shortly.

Fixes kern/8158.

branches: 1.51.4;
completely remove Mach VM support. all that is left is the all the
header files as UVM still uses (most of) these.

No need to get definition of "SYSV..." from "opt_sysv.h" because they
must be set if these files are compiled.

Defopt SYSVMSG, SYSVSEM and SYSVSHM.

Make copyright notices with my name consistent.

Merge paddr_t changes into the main branch.

Abolition of bcopy, ovbcopy, bcmp, and bzero, phase one.
bcopy(x, y, z) -> memcpy(y, x, z)
ovbcopy(x, y, z) -> memmove(y, x, z)
bcmp(x, y, z) -> memcmp(x, y, z)
bzero(x, y) -> memset(x, 0, y)

branches: 1.45.2;
uvm_deallocate() takes an address and a size, not an address range. From
ITOH Yasufumi <yasufu-i@is.aist-nara.ac.jp>, PR #5834.

Various SysV IPC prototype changes.

- add defopt's for UVM, UVMHIST and PMAP_NEW.
- remove unnecessary UVMHIST_DECL's.

initial import of the new virtual memory system, UVM, into -current.

UVM was written by chuck cranor <chuck@maria.wustl.edu>, with some
minor portions derived from the old Mach code. i provided some help
getting swap and paging working, and other bug fixes/ideas. chuck
silvers <chuq@chuq.com> also provided some other fixes.

this is the rest of the MI portion changes.

this will be KNF'd shortly. :-)

Make shmexit() and shmfork() take struct vmspace *'s, not struct proc *'s,
and update internal interfaces appropriately.

Fix error handling - call wakeup() in error case too.

Use a swap pager backed VM object for sysV shm instead of kernel VM.
Mostly from FreeBSD.

branches: 1.38.10;
Calling shmdt(2) before calling shmat(2) would crash the system because
p->p_vmspace->vm_shm would be NULL. Protected the rest of the cases where
that might happen too. This was the reason why sunxdoom would panic the
system in SVR4 emulation.

branches: 1.37.4;
Fix printf() formats.

More proto fixes

First pass at prototyping

Remove unused third arg to shmfork().

Prefix names of system call implementation functions with `sys_'.

Make system calls conform to a standard prototype and bring those
prototypes into scope.

try to insure that the 'default' address for shm segments is the same
from process to process. It apparently is on SysV systems, and some
programs depend on this. Suggested by John Birrell <jb@werple.mira.net.au>.