Zero copy send and receive fixes:

- On receive, vm_map_lookup() needs to trigger the creation of a shadow
  object.  To make that happen, call vm_map_lookup() with PROT_WRITE
  instead of PROT_READ in vm_pgmoveco().

- On send, a shadow object will be created by the vm_map_lookup() in
  vm_fault(), but vm_page_cowfault() will delete the original page from
  the backing object rather than simply letting the legacy COW mechanism
  take over.  In other words, the new page should be added to the shadow
  object rather than replacing the old page in the backing object.  (i.e.
  vm_page_cowfault() should not be called in this case.)  We accomplish
  this by making sure fs.object == fs.first_object before calling
  vm_page_cowfault() in vm_fault().

Submitted by:	gallatin, alc
Tested by:	ken

sys/kern/kern_subr.c

@@ -87,7 +87,7 @@ vm_pgmoveco(vm_map_t mapa, vm_object_t srcobj, vm_offset_t kaddr,
 	kern_pg = PHYS_TO_VM_PAGE(vtophys(kaddr));
 
 	if ((vm_map_lookup(&map, uaddr,
-			   VM_PROT_READ, &entry, &uobject,
+			   VM_PROT_WRITE, &entry, &uobject,
 			   &upindex, &prot, &wired)) != KERN_SUCCESS) {
 		return(EFAULT);
 	}

sys/vm/vm_fault.c

@@ -310,11 +310,18 @@ RetryFault:;
 			int queue, s;
 
 			/* 
-			 * check for page-based copy on write
+			 * check for page-based copy on write.
+			 * We check fs.object == fs.first_object so
+			 * as to ensure the legacy COW mechanism is
+			 * used when the page in question is part of
+			 * a shadow object.  Otherwise, vm_page_cowfault()
+			 * removes the page from the backing object, 
+			 * which is not what we want.
 			 */
 			vm_page_lock_queues();
 			if ((fs.m->cow) && 
-			    (fault_type & VM_PROT_WRITE)) {
+			    (fault_type & VM_PROT_WRITE) &&
+			    (fs.object == fs.first_object)) {
 				s = splvm();
 				vm_page_cowfault(fs.m);
 				splx(s);