Add __TEST_FENV for t_fpclassify to fix the vax build

ctype(3): New environment variable LIBC_ALLOWCTYPEABUSE.

If set, this does not force the ctype(3) functions to crash when
passed invalid inputs -- instead, they will return nonsense results,
and possibly print warnings to stderr, as is their right in
implementing undefined behaviour.

The nature of the nonsense results is unspecified. Currently, is*()
will always return true (even if that leads to mutually contradictory
conclusions, like isalpha and isdigit, or isgraph and isblank), and
tolower/toupper() will always return EOF. But perhaps in the future
the results may be randomized.

This way, if an application like firefox crashes on ctype abuse, you
can opt to accept the consequences of nonsense results instead by
running `env LIBC_ALLOWCTYPEABUSE= firefox' until the application is
fixed.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

branches: 1.60.2;
Add basic tests for timespec_get(3), timespec_getres(3)

PR standards/58608

ctype(3): Disable guard page in static libc.

Adding the guard page may have overflown several small installation
media. Let's try to keep this case small.

Update the tests to detect the cases where we will be running against
a libc without a guard page on the LC_CTYPE=C tables, and skip
testing abuse detection when it would rely on the guard page.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: New test for ctype(3) functions/macros.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

execve(2), posix_spawn(2): Add test case for an embarrassing bug.

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

arc4random(3): Add automatic tests.

This verifies that:
- arc4random zeroes its state and reseeds itself on fork
- arc4random reseeds itself on entropy consolidation (e.g., VM clone)
- arc4random falls back to global state if it can't allocate local
state because address space limits cause mmap to fail

NOTE: This adds a new libc symbol __arc4random_global, but it's in
the reserved namespace and only used by t_arc4random, so no libc
minor bump.

PR kern/58632: getentropy(2) and arc4random(3) do not reseed on VM
fork

branches: 1.55.2; 1.55.4;
libc: Reintroduce getentropy.

This was introduced two years ago when the getrandom/getentropy API
question was still open, and removed because the discussion was
ongoing. Now getentropy is more widely adopted and soon to be in
POSIX. So reintroduce the symbol into libc since we'll be keeping it
anyway. Discussion of details of the semantics, as interpreted by
NetBSD, is ongoing, but the symbol needs to get in before the
netbsd-10 branch. The draft POSIX text is
(https://www.opengroup.org/austin/docs/austin_1110.pdf):

SYNOPSIS
#include <unistd.h>

int getentropy(void *buffer, size_t length);

DESCRIPTION
The getentropy() function shall write length bytes of data
starting at the location pointed to by buffer. The output
shall be unpredictable high quality random data, generated by
a cryptographically secure pseudo-random number
generator. The maximum permitted value for the length
argument is given by the {GETENTROPY_MAX} symbolic constant
defined in <limits.h>.

RETURN VALUES
Upon successful completion, getentropy() shall return 0;
otherwise, -1 shall be retunred and errno set to indicate the
error.

ERRORS
The getentropy() function shall fail if:

[EINVAL] The value of length is greater than
{GETENTROPY_MAX}.

The getentropy() function may fail if:

[ENOSYS] The system does not provide the necessary
source of entropy.

RATIONALE
The getentropy() function is not a cancellation point.

Minor changes from the previous introduction of getentropy into libc:

- Return EINVAL, not EIO, on buflen > 256.
- Define GETENTROPY_MAX in limits.h.

The declaration of getentropy in unistd.h and definition of
GETENTROPY_MAX in limits.h are currently conditional on
_NETBSD_SOURCE. When the next revision of POSIX is finalized, we can
expose them also under _POSIX_C_SOURCE > 20yymmL as usual -- and this
can be done as a pullup without breaking existing compiled programs.

Update t_siginfo.c build rules

Add logic for MKSANITIZER/MKLIBCSANITIZER checks.

-frounding-math is gcc specific, help clang builds

PR/54000: Andreag Gustafsson: Compile the rounding test with
-fround-math since with gcc-7, the default mode ignores fenv settings
(the same effect can be achieved with -O0 :-)

https://gcc.gnu.org/wiki/FloatingPointMath

branches: 1.51.12;
remove exect, it will not be fixed and it will be removed.

branches: 1.50.2;
Attach t_exect to ATF tests and distribution

Add missing SIGTRAP handler. Assert there that the signal is SIGTRAP as
expected and si_code TRAP_TRACE.

This test will break on some ports that have dummy or incomplete
implementation of exect(2).

This test works on amd64 correctly.

Sponsored by <The NetBSD Foundation>

branches: 1.49.2;
Add __TEST_FENV

Put have fenv elsewhere.

Sync list of fenv enabled architectures again (PR 48633), this time for mips
addition.

While PR 48633 is not properly fixed, keep the additional lists of
fenv-enabled architectures in sync.

Build t_fpgetmask/t_fpgetround for aarch64 since they are now in libc

Enable fenv for arm

Do not set HAVE_FENV for arm as long as it misses feenableexcept().

Use the same condition for HAVE_FENV

Changes to existing files to enable building AARCH64 userland.
evbarm64-el
This is clang only. While gcc4.8 supports aarch64, no netbsd support has
been written for aarch64 with gcc4.8.

Minimal execve(2) ATF test.

branches: 1.39.2;
Add test for uint64 to real long double conversion.

Convert old src/regress/timer&waiter tests to ATF

branches: 1.37.2;
Do not re-add -mieee option on alpha, it's already set by default.

Add a case for PR lib/41558. It is unclear whether this is a bug, but at
least it is documented now. Probably it would be better to follow Linux,
where the test case does not fail.

Add few basic tests for realpath(3).

Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

Few naive checks for cpuset(3) and ftok(3).

Few naive checks for time(3).

branches: 1.31.2;
Make the rounding test work properly, and actually test the rounding modes.

Move duplicate ldexp(3) test out from the tests/libc.

Move the tests/libc/ieeefp to tests/libc/gen to match the structure of libc.
Also rename the test files to gain functional scope.

Move 't_glob_star' to 't_glob' for glob(3).

Move 't_syslog_pthread' to 't_syslog' for consistency with libc.

Test that assert(3) works.

Test also setdomainname(3).

Few naive tests for sethostname(3).

branches: 1.23.2;
Few naive tests for pause(3).

Few basic tests for closefrom(3).

Try to mirror the real source with the test directory structure (otherwise
the latter carries a risk of becoming a difficult mess to manage.)

Few fundamental consistency checks for alarm(2).

Test nice(3) also with threads.

A naive test case for getcwd(3).

Add simple test cases for ttyname(3), strtod(3), and getgrent(3).

Few simple tests for nice(3).

Sort.

Add a naive test case for raise(3).

Continuing the (re)organization of the lib/libc atf regression tests

One more reference to HAVE_SIGINFO bites the dust

Build t_ldexp test always. The test itself determines if it is running
on an unsupported platform (vax) and exits.

Fix name of t_ldexp test from previous

Don't build ldexp tests on vax

Migrate the ldexp test to atf

Migrate the remaining libc/gen tests to atf

Correctly added the conditional part, but now need to remove the original
unconditional part.

Don't include the siginfo tests unless we actually have siginfo ability!

Move the siginfo tests from regress to atf. While here, add a new test
for PR/43655.

XXX The sigchild_dump test currently fails when execute under atf-run.
XXX It does not fail when executed directly from the shell, so there's
XXX something in atf that prevents the child process from dumping.

Migrate a couple more tests from the old regress structure to atf

Add an isolated test case for PR lib/44248.

Add tests for GLOB_STAR

branches: 1.1.4;
execve(2), posix_spawn(2): Fix build of tests after previous.

Forgot to add a file.

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

branches: 1.2.2;
ctype(3): Fix build of tests on machines with unsigned char.

Could maybe phrase this better but this'll do for now.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

ctype(3): New environment variable LIBC_ALLOWCTYPEABUSE.

If set, this does not force the ctype(3) functions to crash when
passed invalid inputs -- instead, they will return nonsense results,
and possibly print warnings to stderr, as is their right in
implementing undefined behaviour.

The nature of the nonsense results is unspecified. Currently, is*()
will always return true (even if that leads to mutually contradictory
conclusions, like isalpha and isdigit, or isgraph and isblank), and
tolower/toupper() will always return EOF. But perhaps in the future
the results may be randomized.

This way, if an application like firefox crashes on ctype abuse, you
can opt to accept the consequences of nonsense results instead by
running `env LIBC_ALLOWCTYPEABUSE= firefox' until the application is
fixed.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

branches: 1.1.4;
execve(2), posix_spawn(2): Add test case for an embarrassing bug.

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

When running the tests under "qemu -accel kvm" on a Linux host,
isQEMU_TCG() should return false. Fixes multiple test cases that were
failing with "Test case was expecting a failure but none were raised"
on that platform.

Provide separate functions to check for running under qemu in general
and for running under qemu's built-in TCG CPU emulation (as opposed to
hardware virtualization via NVMM or KVM).

Need stdlib.h for EXIT_FAILURE

branches: 1.3.2; 1.3.8; 1.3.10;
Mark the test function as inline, so we don't get warnings if it is not
actually used.

don't pay for sysctl if we don't have to.

easier way to find if we are on qemu.

Fix comment/string typos.

Few fundamental consistency checks for alarm(2).

branches: 1.5.4;
arc4random(3): Provide a fallback in case pthread_atfork fails.

This is considerably more work and burden on testing than simply
statically preallocating a bit of storage for pthread_atfork to
eliminate the failure mode altogether, but it is less work than
arguing further over the atfork interface:
https://mail-index.NetBSD.org/source-changes-d/2025/03/02/msg014387.html

PR lib/59117: arc4random has some failure modes it shouldn't

t_arc4random: Test arc4random_global.per_thread, not .initialized.

If arc4random_initialize has been called, and thr_keycreate failed,
then .initialized will be true but .per_thread will be false -- and
.thread_key will be garbage (some other thread key for another
purpose, most likely). This path was enabled by allowing
thr_keycreate to fail instead of aborting the process.

This hasn't caused trouble yet, mainly because we don't do anything
to inject faults into thr_keycreate in these tests. Tweak the
global_threadkeylimit test while here to provoke a crash with the
wrong conditional.

Fix a similar edge case in the little test program embedded in
arc4random.c (which should maybe just go away now that we have atf
tests).

PR lib/59117: arc4random has some failure modes it shouldn't

t_arc4random: Verify arc4random works without fds.

It must work in an empty chroot where /dev/urandom doesn't exist, and
it must work when the file descriptor resource limit is exceeded.

Prompted by discussion around:

PR lib/59117: arc4random has some failure modes it shouldn't

Fortunately these are not failure modes of the current arc4random
implementation! But it is important to test them nevertheless, to
forestall any temptation to invent new failure modes.

arc4random(3): Avoid failure due to thread key limits.

If thr_keycreate (a.k.a. pthread_key_create) fails, fall back to
using globally serialized state instead of per-thread state. This is
unlikely to happen but arc4random(3) should work even if it does.
New test case forces exercising this path (at least, simulating the
effect of key creation failure).

PR lib/59117: arc4random has some failure modes it shouldn't

branches: 1.1.2;
arc4random(3): Add automatic tests.

This verifies that:
- arc4random zeroes its state and reseeds itself on fork
- arc4random reseeds itself on entropy consolidation (e.g., VM clone)
- arc4random falls back to global state if it can't allocate local
state because address space limits cause mmap to fail

NOTE: This adds a new libc symbol __arc4random_global, but it's in
the reserved namespace and only used by t_arc4random, so no libc
minor bump.

PR kern/58632: getentropy(2) and arc4random(3) do not reseed on VM
fork

PR/51807: Ngie Cooper: disable core file generation in :assert_false,
:assert_true

branches: 1.2.2; 1.2.26;
Avoid ATF_REQUIRE() inside a child process.

Test that assert(3) works.

Rename some test case names for consistency. No functional change.

Migrate a couple more tests from the old regress structure to atf

s/sould/should/ and s/shoud/should/

Adjust.

On a second thought, require that close(2) fails for a descriptor already
closed with closefrom(3). For some odd reason (yet to be determined), this
check fails on 5.99.51 (amd64).

Remove superfluous close(2) pointed out by martin@.

Few basic tests for closefrom(3).

branches: 1.1.2;
Few naive checks for cpuset(3) and ftok(3).

ctype(3): New environment variable LIBC_ALLOWCTYPEABUSE.

If set, this does not force the ctype(3) functions to crash when
passed invalid inputs -- instead, they will return nonsense results,
and possibly print warnings to stderr, as is their right in
implementing undefined behaviour.

The nature of the nonsense results is unspecified. Currently, is*()
will always return true (even if that leads to mutually contradictory
conclusions, like isalpha and isdigit, or isgraph and isblank), and
tolower/toupper() will always return EOF. But perhaps in the future
the results may be randomized.

This way, if an application like firefox crashes on ctype abuse, you
can opt to accept the consequences of nonsense results instead by
running `env LIBC_ALLOWCTYPEABUSE= firefox' until the application is
fixed.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

branches: 1.11.2; 1.11.4;
ctype(3): Disable guard page in static libc.

Adding the guard page may have overflown several small installation
media. Let's try to keep this case small.

Update the tests to detect the cases where we will be running against
a libc without a guard page on the LC_CTYPE=C tables, and skip
testing abuse detection when it would rely on the guard page.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

ctype(3): Put guard pages before the C ctype/tolower/toupper tables.

This also only affects machines where char is signed for now. (But
maybe it would be worth doing unconditionally; users could still try
to pass in explicit `signed char' inputs.)

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

ctype(3): Summon a demon from caller's nose if abused out-of-line.

This way, applications which opt for the out-of-line functions will
crash with a potentially meaningful message to stderr if they pass
inputs on which the ctype(3) functions are undefined. (If fd 2 is
something else, tough -- this is nasal demon country, and they fly
where they please, application intent be damned.)

This probably won't catch many applications -- but it might catch C++
applications at runtime that can't be caught at build-time because
they eschew the macros.

The cost is a single predicted-not-taken branch -- it's checking c
for membership in the interval [-1,0xff] when we're already computing
c + 1, so it can be a single unsigned-compare. By deferring the
message and abort to an out-of-line function we avoid a stack frame
in the good case. And this is for the unlikely, out-of-line versions
of the ctype(3) functions -- most applications get the inline macros.
So I'm not concerned by the prospect of a performance impact.

Update the tests so they recognize SIGABRT as noisy failure too, not
just SIGSEGV.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: More const is more better!

No functional change intended -- we never intended to write to this
array anyway.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: Factor loop out of macro-generated functions.

No functional change intended.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: Test some more code points with potential for EOF confusion.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: Include UCHAR_MAX in the range of inputs tested.

It should definitely be included because it is important to distinguish
it from EOF!

Noted by rillig@.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: Test explicit setlocale(LC_CTYPE, "C").

And do so after other setlocales -- just in case this behaves
differently from the default environment before any setlocale.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

libc: Put guard pages before locale ctype/tolower/toupper tables.

This way, triggering the undefined behaviour of negative inputs to
the ctype functions leads to instant SIGSEGV, rather than silently
giving bonkers (and likely nondeterministic) answers. (See ctype(3)
man page for details.)

This only affects non-default locales, i.e., locales other than C.
The C locale's tables are statically linked into libc, and the
symbols defining them are baked into the ABI, so putting a guard page
before them will require either some careful elven surgery (which is
a class I must have missed back in university), or copying them into
dynamically allocated memory (which is a cost I'm reluctant to incur
on all programs using libc).

This also only affects machines where char is signed for now. (But
maybe it would be worth doing unconditionally; users could still try
to pass in explicit `signed char' inputs.)

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: Fix tests on platforms where char is unsigned.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

t_ctype: New test for ctype(3) functions/macros.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

No semicolon after macro do ... while (0) wrapper.

branches: 1.10.12;
more error checks

fix mismatched paren, also the previous commit should say and check error
for -1.

wrap the macro in do/while.

PR/51808: Ngie Cooper: fix leaks, sort includes, check returns

branches: 1.6.8;
fix unused variable warnings

branches: 1.5.2;
To be on the safe side, use the category/number notation when referring to
PRs (otherwise third-party sed-scripts might miss the references). Also
remove white-space.

branches: 1.4.2;
Rename some test case names for consistency. No functional change.

Turn warns on for all tests and fix all the bugs.

branches: 1.2.2;
Remove the following (literal) text in the TNF copyrights:

* This code is derived from software contributed to The NetBSD Foundation
* by
*

XXX: If these originated from you and you want your name to be mentioned,
please add it.

Migrate the remaining libc/gen tests to atf

tests/lib/libc/gen/t_floatunditf: Nix __HAVE_LONG_DOUBLE conditional.

Conversion from uint64_t to long double should work on all ports,
including those where long double is the same as double, i.e., where
__HAVE_LONG_DOUBLE is undefined.

Instead, conditionalize the test cases on how many bits of precision
long double has in the significand, according to LDBL_MANT_DIG. The
conditionals here should handle binary128, powerpc double-dekker
(~106-bit precision), x86 extended precision (80-bit), m68k extended
precision (80-bit), and VAX D (56-bit).

PR misc/49356 remove unnecessary references to atf-c/config.h

The function included via this header is not used and is removed in
later versions of atf, so let us avoid it.

branches: 1.5.4; 1.5.8;
Add a few more test values from the range that sparc64 previously would
have got wrong.

Skip testcase inside its body for architectures w/o long double support

Print a slightly more helpfull message in case of test failure

No unused functions if there is no long double support.

Add test for uint64 to real long double conversion.

tests/fmtcheck: show that fmtcheck does not support "%2$s"

Revert rev 1.4: fmtcheck(3) neglect unused trailing arguments as before.
"%d" is a valid format string with default format string "%d %s", etc.

Correct a couple of broken test cases:
"%d" does not take the same args as "%d %s"
"%%" does not take the same args as "%llx"
How did these ever survive any kind of even basic sanity check?

Update fmtcheck(3) test now that pointers and longs are differentiated.

branches: 1.2.8; 1.2.18;
Rename some test case names for consistency. No functional change.

Migrate the remaining libc/gen tests to atf

Add another case related to the ones from PR 49278: [A-\\].

branches: 1.6.2;
You need double the number of backslashes in a pattern, since \\ -> '\' in
the string which means escape. Now the tests don't fail.

Add expect fail for PR lib/49278

Add some fnmatch test cases from other C library test suites

branches: 1.3.2;
Append few basic test cases.

PR/41558 has been fixed.

Add a case for PR lib/41558. It is unclear whether this is a bug, but at
least it is documented now. Probably it would be better to follow Linux,
where the test case does not fail.

t_fpclassify: Fix build properly without __HAVE_LONG_DOUBLE.

Centralize use of union ieee_ext_u, used on machines where double is
not the same as long double, so most of the long double code doesn't
need __HAVE_LONG_DOUBLE conditionals (reminder: __HAVE_LONG_DOUBLE
means long double is _larger_ than double, not just that long double
exists; long double always exists and should work either way).

PR standards/59336: C23: Annex F and math.h extensions
PR lib/59853: compiler-rt softfloat lacks floating-point exceptions

t_fpclassify: Revert previous -- __HAVE_LONG_DOUBLE is used wrongly.

__HAVE_LONG_DOUBLE being defined means long double is _different_
from double (typically 80-bit or 128-bit extended precision), and not
being defined means long double is the same as double.

Any code that uses ordinary long double arithmetic or long double
libm functions should work with or __HAVE_LONG_DOUBLE.

But without __HAVE_LONG_DOUBLE, we don't have things like union
ieee_ext_u for breaking apart the internal representation.

Will re-fix the build in a subsequent change coming up momentarily.

Make this build on platforms without __HAVE_LONG_DOUBLE.

t_fpclassify: Fix long double mistakes.

1. Handle >64-bit long double with `union ieee_ext_u'.
2. Operationally verify the quiet vs signalling NaN bits.
3. xfail for softfloat and softfloat-long-double bugs on clang.
4. Print NaN encodings in hexadecimal to make diagnostics easier.
5. Add RCS id.

PR standards/59336: C23: Annex F and math.h extensions
PR lib/59853: compiler-rt softfloat lacks floating-point exceptions

make this compile again.

t_fpclassify: Test the is* classification functions too.

Also test the upcoming C23 functions (iszero, issubnormal,
issignalling), so the tests will be there when we implement them, and
test the floating-point exceptions all the functions involved raise
(which should be none).

PR standards/59336: C23: Annex F and math.h extensions

t_fpclassify: Fix build on vax after #if'ing out subnormal tests.

Must've neglected to compile-test this _on vax_, oops.

PR port-vax/59261: t_fpclassify tests are failing

tests: Use `#if __*_HAS_DENORM__', not `#ifdef __*_HAS_DENORM__'.

The compiler defines this to zero on, e.g., VAX.

PR port-vax/59261: t_fpclassify tests are failing

branches: 1.6.2;
tests/lib/libc/gen/t_fpclassify: Test fpclassify on non-IEEE754 too.

Just exclude the subnormal parts on non-IEEE754 architectures
according to __FLT/DBL/LDBL_HAS_DENORM__.

tests/lib/libc/gen/t_fpclassify: Spruce this up a bit.

Provide more useful diagnostics when tests fail.

tests/lib/libc/gen/t_fpclassify: Enable long double tests.

The necessary long double symbols should all be available now. If
there are any architectures where they're not, we can fix those
architectures.

branches: 1.3.44; 1.3.52;
add a missing E

use _FLOAT_IEEE754 instead of vax.

Move the tests/libc/ieeefp to tests/libc/gen to match the structure of libc.
Also rename the test files to gain functional scope.

t_fpsetmask, t_fenv: Skip fp exception trap tests on RISC-V.

No architectural support for fp exception traps.

While here, make the macros behave a little better as C statements.

Expect failure only when running under qemu's TCG CPU emulation, not
when running under hardware virtualization such as qemu -accel nvmm.

Fix typo in 'exceptions'

Clean up terminology: modern arm CPUs do properly implement IEEE 754
floating point exceptions - but some (actually all currently know ones)
do not implement sending traps when these exceptions are raised.

Pointed out by Peter Maydell.

There are aarch64 Cortex cpus that do not trap on some floating point
exceptions - so apply the arm handling for aarch64 as well.

port-macppc/46319 is marked as resolved now.
Test on 8.99.26 build of NetBSD/macppc

branches: 1.16.14; 1.16.16;
Fix masking for the fpsetmask_basic test, pointed out by Timo Buhrmester

Skip the tests on ARM if the NEON fpu does not support exceptions (Cortex).

PR misc/49356 remove unnecessary references to atf-c/config.h

The function included via this header is not used and is removed in
later versions of atf, so let us avoid it.

Use compiler builtins instead of atf_arch and atf_machine.

The atf_arch and atf_machine configuration variables were removed from
atf-0.19 without me realizing that some tests were querying them directly.

Instead of reintroducing those variables, just rely on compiler builtins
as many other tests already do.

Should fix PR bin/48582.

Backout previous - which did not include the change described in the log
message anyway but pure accidental white space changes. The whole change
was not needed any more after fixing isqemu.h.
Thanks to agc for pointing it out.

Do not include isqemu.h if we are not going to use the test

easier way to find if we are on qemu.

branches: 1.9.2;
Xfail on qemu unconditionally after all.

Flip previous (i386/qemu fails, not the amd64/qemu).

Revisit the previous: fails on qemu/amd64 but not qemu/i386.

As it turned out, the fpsetmask(3) tests were unnecessarily skipped on Qemu.
Thus, remove xfails that do not trigger.

Do not skip the tests on Qemu, but point to PR misc/44767 instead.

Point to port-macppc/46319 when failing on macppc.

branches: 1.3.2;
Add basic fpsetmask test to exercize setting/clearing bits.

use _FLOAT_IEEE754 instead of vax.

Move the tests/libc/ieeefp to tests/libc/gen to match the structure of libc.
Also rename the test files to gain functional scope.

fpsetround(3): Don't toggle all the other bits in fpcr on aarch64.

PR port-arm/58782: fpsetround flips all the other fpcsr bits on aarch64

fpsetround(3): Test that this doesn't flip on FTZ by accident.

PR port-arm/58782: fpsetround flips all the other fpcsr bits on aarch64

branches: 1.6.44; 1.6.52; 1.6.54;
use _FLOAT_IEEE754 instead of vax.

add more tests.

add symbolic name printing.

print stderr, when things go wrong.

Make the rounding test work properly, and actually test the rounding modes.

Move the tests/libc/ieeefp to tests/libc/gen to match the structure of libc.
Also rename the test files to gain functional scope.

PR misc/54382: whenever open(2) is called with O_CREAT, make sure to
pass an open mode argument.

branches: 1.2.14;
PR/51809: Ngie Cooper: fix file descriptor leak

branches: 1.1.2; 1.1.24;
Few naive checks for cpuset(3) and ftok(3).

As per PR bin/45180, do not traverse too deep.

Use proper format strings.

branches: 1.1.2;
A naive test case for getcwd(3).

libc: Reintroduce getentropy.

This was introduced two years ago when the getrandom/getentropy API
question was still open, and removed because the discussion was
ongoing. Now getentropy is more widely adopted and soon to be in
POSIX. So reintroduce the symbol into libc since we'll be keeping it
anyway. Discussion of details of the semantics, as interpreted by
NetBSD, is ongoing, but the symbol needs to get in before the
netbsd-10 branch. The draft POSIX text is
(https://www.opengroup.org/austin/docs/austin_1110.pdf):

SYNOPSIS
#include <unistd.h>

int getentropy(void *buffer, size_t length);

DESCRIPTION
The getentropy() function shall write length bytes of data
starting at the location pointed to by buffer. The output
shall be unpredictable high quality random data, generated by
a cryptographically secure pseudo-random number
generator. The maximum permitted value for the length
argument is given by the {GETENTROPY_MAX} symbolic constant
defined in <limits.h>.

RETURN VALUES
Upon successful completion, getentropy() shall return 0;
otherwise, -1 shall be retunred and errno set to indicate the
error.

ERRORS
The getentropy() function shall fail if:

[EINVAL] The value of length is greater than
{GETENTROPY_MAX}.

The getentropy() function may fail if:

[ENOSYS] The system does not provide the necessary
source of entropy.

RATIONALE
The getentropy() function is not a cancellation point.

Minor changes from the previous introduction of getentropy into libc:

- Return EINVAL, not EIO, on buflen > 256.
- Define GETENTROPY_MAX in limits.h.

The declaration of getentropy in unistd.h and definition of
GETENTROPY_MAX in limits.h are currently conditional on
_NETBSD_SOURCE. When the next revision of POSIX is finalized, we can
expose them also under _POSIX_C_SOURCE > 20yymmL as usual -- and this
can be done as a pullup without breaking existing compiled programs.

Typo in error message.

Add simple test cases for ttyname(3), strtod(3), and getgrent(3).

t_glob.c: clean up test code

In struct vfs_file, using an int as a boolean is an anachronism and has
been replaced with a single-character file type, like in ls(1).

Some other redundant test code has been removed as well since it was
either unreachable or existed only for performance reasons.

t_glob.c: add test cases for hidden directory and file

The existing test code was geared towards every little bit of
performance. It even duplicated the file definitions in vfs_stat in order
to avoid a few strcmp calls. This made the test code fragile. Therefore,
vfs_stat has been rewritten completely to not duplicate any information
from the vfs.

In vfs_stat, the returned st_mode is now more realistic. It had been 0
before. The file mode is only logged when it makes sense. In the ENOENT
case it is not logged anymore.

The debug logging for opendir/closedir now logs the same pointer, so that
the corresponding calls can be matched easily. Failed vfs_opendir calls
are logged as well, to get a more complete picture of which callbacks are
called.

t_glob.c: use distinct names for test structures

Before, the structures and functions defined by the test used the same
prefix as the code to be tested. This made it difficult to draw a line
between these parts.

t_glob.c: move expected globbing result directly into the test cases

This makes the tests more self-contained. The example directory tree that
is common to all the tests is still defined elsewhere, but in the same
file. Setting up the example directory structure in each test would make
the tests even more independent and read.

branches: 1.6.10;
- add range tests
- be more descriptive about errors

branches: 1.5.4;
PR/51825: Ngie Cooper: use the non _ version of the macro

Don't play with "../.." in includes for h_macros.h; deal with it centrally.
Minor fixes.

branches: 1.3.12;
Remove check for GLOB_NOCHECK - the behaviour has been changed again, so it
will return a modified pattern.

- make our stat function return ENOENT if a file is not found.
- add a GLOB_NOMATCH check

branches: 1.1.2; 1.1.8;
Move 't_glob_star' to 't_glob' for glob(3).

Move 't_glob_star' to 't_glob' for glob(3).

Rename some test case names for consistency. No functional change.

add Makefile.inc everywhere so that we can set WARNS=4 by default. Amazing
how many bugs this found :-)

Use actual buffer size instead of sizeof(char *). Makes the test
work on non-64bit platforms.

fix -DDEBUG

use "RZ()" instead of ATF_CHECK(), since ATF_CHECK does not deal with errno.
This is repulsive, specially the part about hard-coding the h_macros.h file
in the c code.

don't use err(), from pooka.
CV: ----------------------------------------------------------------------

Add tests for GLOB_STAR

Explicitly test for PR lib/54053

A suitable test was actually there already - but the results
were not verified. So just add a test that the result string
is what is expected. (Previously for len==128 and bytes==10000
it would have returned "0E" now it returns 10000 as it should.)

branches: 1.9.14;
PR/51810: Ngie Cooper: don't leak buf

branches: 1.8.14;
To be on the safe side, use the category/number notation when referring to
PRs (otherwise third-party sed-scripts might miss the references). Also
remove white-space.

This does not fail anymore. Explain why the test was modified.

Mark w_printf as __printflike and fix a format string error.

branches: 1.5.2; 1.5.4;
Rename some test case names for consistency. No functional change.

Turn warns on for all tests and fix all the bugs.

branches: 1.3.2;
Mark this also as expected failure.

Formally verify the numerous bugs in humanize_number(3).
From PR lib/44097, by yamt@.

Migrate the remaining libc/gen tests to atf

tests/lib/libc/gen/t_isnan: Fix architecture conditionals.

1. Skip isinf_basic on VAX. We have no other way to query `does this
architecture support infinities?' and other tests already use
isinf(HUGE_VAL) to determine that, so let's just make sure it
works correctly on VAX.

2. Don't skip these tests on m68k. This was originally conditional
on m68000 (which is to say, NetBSD's MACHINE_ARCH for Motorola
68010 CPUs, i.e., the sun2 port), and was later mistakenly changed
to m68k. But there's no reason any m68k, 68010 or later, should
skip this -- the floating-point format of the ABI does have NaN
and infinity, whether it's a softfloat ABI or hardfloat ABI.

PR misc/59266: t_isnan:isinf_basic test is bogus on some ports

branches: 1.5.28;
PR misc/49356 remove unnecessary references to atf-c/config.h

The function included via this header is not used and is removed in
later versions of atf, so let us avoid it.

Use compiler builtins instead of atf_arch and atf_machine.

The atf_arch and atf_machine configuration variables were removed from
atf-0.19 without me realizing that some tests were querying them directly.

Instead of reintroducing those variables, just rely on compiler builtins
as many other tests already do.

Should fix PR bin/48582.

Retry previous

Make it compile on archs where NAN is not defined - previously it only
compiled by chance (and details of the __isnan macro) on vax.

branches: 1.1.2; 1.1.8;
Move the tests/libc/ieeefp to tests/libc/gen to match the structure of libc.
Also rename the test files to gain functional scope.

Move duplicate ldexp(3) test out from the tests/libc.

Remove the following (literal) text in the TNF copyrights:

* This code is derived from software contributed to The NetBSD Foundation
* by
*

XXX: If these originated from you and you want your name to be mentioned,
please add it.

Adjust tests now that the values of atf_arch and atf_machine have been
reversed to carry their real intended meanings.

This is part of PR bin/44305.

branches: 1.3.2;
Don't run FP Exception tests under qemu - they don't work.

While here, properly skip certain tests on vax architecture. (It is
not legal to have a test-program with zero test cases, so each test
case needs to check-and-skip.)

Build t_ldexp test always. The test itself determines if it is running
on an unsupported platform (vax) and exits.

Migrate the ldexp test to atf

Move the references to PRs from code comments to the test description. Once
ATF has the ability to output the metadata in the HTML reports, it should be
easy to traverse between releng and gnats -reports via links.

branches: 1.7.4;
PR lib/42587 was fixed; remove xfail.

In nice_err testcase, use ATF_REQUIRE_ERRNO.

Test nice(3) also with threads.

"wrong return value" -> "wrong errno".

As there is PR lib/42587, mark tiny POSIX error as expected failure.

Use _exit(2).

Few simple tests for nice(3).

Few naive tests for pause(3).

Prefer modern simple past tense and past participle of catch

The "catched" form is obsolete and nonstandard, prefer "caught".

branches: 1.5.26;
Add also a simplistic stress unit test.

Add one more naive unit test.

Rename some tests. No functional change.

Add missing __RCSID(3).

Add a naive test case for raise(3).

Reduce the number of loops.
It avoids timeout on slow machines, and I think that 100,000
times loop also satisfies the evaluation.
PR lib/49664 (no comments)

uint64_t -> uint32_t. 32bit is sufficient in this case
and it improved the performance approx 7% on my 68030.
see also PR lib/49664.

Rename some test case names for consistency. No functional change.

Repair some printf formats

Continuing the (re)organization of the lib/libc atf regression tests

Try to mirror the real source with the test directory structure (otherwise
the latter carries a risk of becoming a difficult mess to manage.)

Remove the following (literal) text in the TNF copyrights:

* This code is derived from software contributed to The NetBSD Foundation
* by
*

XXX: If these originated from you and you want your name to be mentioned,
please add it.

Migrate the remaining libc/gen tests to atf

branches: 1.2.2;
Adjust the memset size to not override the nul byte at the end of buffer
array.

Add few basic tests for realpath(3).

Be UTF8 clean.

branches: 1.1.2; 1.1.4;
Test also setdomainname(3).

Be UTF8 clean.

branches: 1.2.2; 1.2.4;
Cleanup.

Few naive tests for sethostname(3).

t_siginfo:adraln: Brush up skip message for x86

Note that:

1. No data address is reported back for alignment check exception, as per
Intel SDM (June 2024).

2. Kernel sets faulting PC to si_addr.

3. 2. is compliant to siginfo(2), at least:

> For SIGILL, SIGFPE, SIGBUS and SIGSEGV ... si_addr contains
> the address of the faulting instruction or data and ...

4. IEEE Std 1003.1-2024 does not require si_addr for SIGBUS. For SIGILL
and SIGSEGV, e.g., it is required (SHALL) to store faulting PC and
data address, respectively, on the other hand.

t_siginfo:sigbus_adraln: Skip rather than expect_fail on x86

This is an architecture-defined behavior, not a failure.

branches: 1.53.2;
t_siginfo: sigbus_adraln: Skip for vax

According to "VAX Architecture Handbook", misaligned access does
not trap, although it has performance penalty.

t_siginfo: More volatile to prevent optimization.

t_siginfo: Use volatile to prevent optimization.

t_siginfo: No SIGFPE on RISC-V.

t_siginfo:sigfpe_int: Adjust for GCC12

Do not use constant 1 as numerator to raise integer division by zero.
GCC >= 12 optimizes (1 / i) into (abs(i) == 1 ? i : 0), even for -O0.

RISC-V support that works on QEMU with a single hart.

Thanks for Simon Burge for plic(4).

branches: 1.47.2;
Skip sigfpe_int also for sh3; integer division by zero is not trapped.

s/occured/occurred/ in comments, log messages and man pages.

skip sigbus_adraln on MIPS

PR/55715: pmax testbed panics with "assertion "asid == curcpu()->ci_pmap_asid_cur" failed"

It's GXemul that has the bug! Unfortunately, there's no way (currently) to
detect if we're running under GXemul emulation, so disable for all mips
for now. Hopefully, GXemul will get fixed soon.

PR/55715: pmax testbed panics with "assertion "asid == curcpu()->ci_pmap_asid_cur" failed"

disable the sigbus_adraln test on qemu for now

For aarch64eb, no SIGBUS signal for unaligned accesses.
Convert to preprocessor directives.

Expect a failure to trap unaligned acesses only when running under
qemu's TCG CPU emulation, not when running under hardware virtualization
such as qemu -accel nvmm.

Skip sigbus_adraln for powerpc.

SIGBUS for unaligned accesses is not mandatory for powerpc;
most processors (not all, e.g., 403) can deal with that.

Disable the t_siginfo test under MKSANITIZER / MKLIBCSANITIZER

Signal crash events are incompatible with sanitizers.

Mark division by 0 as expected in sigfpe_int

Disable ubsan instrumentation on the operation.

aarch64 doesn't trap integer division by zero either.

Fix typo in 'exceptions'

Clean up terminology: modern arm CPUs do properly implement IEEE 754
floating point exceptions - but some (actually all currently know ones)
do not implement sending traps when these exceptions are raised.

Pointed out by Peter Maydell.

aarch64 does not trap on unaligned acces

There are aarch64 Cortex cpus that do not trap on some floating point
exceptions - so apply the arm handling for aarch64 as well.

branches: 1.32.2; 1.32.4;
Improve portability of headers and sort them.

From Ngie Cooper in PR bin/51833

reenable sigfpe_flt on powerpc now that FPU exceptions work.

branches: 1.30.2; 1.30.4;
Add __TEST_FENV

m68k (except sun2) never issue SIGBUS on unaligned accesses.
PR lib/49653. Thanks martin@.

Fix strange editor mishap and start block comment on its own line.

Include <ieeefp.h> even for the <fenv.h> case since we use fpsetmask()
to detect ARM Cortex NEON fpus.

Skip the SIGFPE test on arm when the FPU does not provide exception handling.

Use machdep.unaligned_sigbus to skip the unaligned access test on arm
as well.

PR misc/49356 remove unnecessary references to atf-c/config.h

The function included via this header is not used and is removed in
later versions of atf, so let us avoid it.

Use compiler builtins instead of atf_arch and atf_machine.

The atf_arch and atf_machine configuration variables were removed from
atf-0.19 without me realizing that some tests were querying them directly.

Instead of reintroducing those variables, just rely on compiler builtins
as many other tests already do.

Should fix PR bin/48582.

Support using fenv instead of fpsetmask if HAVE_FENV is defined.

Use English spelling of alignment.

use one qemu test

easier way to find if we are on qemu.

branches: 1.18.2;
Skip sigbus_adraln testcase on alpha unless global
machdep.unaligned_sigbus sysctl is enabled.

Revert previous, si_addr is expected to be the faulting *data* address
(mmm, consistent standards).
Add a few tweaks to prevent the compiler's optimizer outsmarting the test.

Do not compare si_addr (address of faulting instruction) against the
unaligned data address causing the fault - this will always fail.
If anybody knows a portable way to get the data address involved in the
fault, please fix the test case as originally intended.

ATF test for SIGBUS => BUS_ADRALN (invalid address alignment).

That one is tedious to test under x86: alignment exceptions are
not reported by this architecture unless you ask for them explicitely (by
setting the PSL_AC bit). The brokenness does not end there: %cr2 should
contain the address where the unaligned access occured, alas, it does not.

I am not aware of other architectures where this could happen. Still, my
knowledge is limited; if there is one, feel free to send me a mail and I
will update the test accordingly.

Adding insult to injury, this test can fail in various funny ways with VMs:
- under x86 QEMU, no trap() happens. As ring 3 code stays almost untouched by
QEMU VMM, I suppose the exception can only be triggered when the host
itself is capable of catching unaligned accesses.
- under Virtual Box with HVM support, i386 works fine, but amd64 fails with a
SIGILL (Illegal instruction) that happens right before entering the
signal handler. No idea why, and trying to debug it with gdb freezes the VM
(including ddb breaks).

Anyway, tested with:
- i386: P4 host, anita, Virtual Box HVM (Mac OS X)
- amd64: anita, Virtual Box HVM (Mac OS X)

XXX I would appreciate if someone could test it under a real amd64 host with
an up-to-date kernel, so I can reasonably assume that the culprit is
Virtual Box and not our amd64 port (my test machine being off line
I cannot do it myself). Results from other arches would be a plus too.

Initial issue reported by Nicolas Joly on port-amd64. Thanks!

To be on the safe side, use the category/number notation when referring to
PRs (otherwise third-party sed-scripts might miss the references). Also
remove white-space.

annotate the PR that failed, and has been fixed.

branches: 1.12.2;
use _FLOAT_IEEE754 instead of vax.

Use volatile for explicit 0 dereference

Skip the sigfpe_flt and sigfpe_int tests on powerpc; powerpc does
not fault on divide-by-zero. As discussed on tech-userlevel.

Attempt further qemu heuristics to avoid failures due to non-working FPU

branches: 1.8.2;
Don't run FP Exception tests under qemu - they don't work.

While here, properly skip certain tests on vax architecture. (It is
not legal to have a test-program with zero test cases, so each test
case needs to check-and-skip.)

If we survive the check for wrong signal code, reset our expectation to
"pass" before checking the signal errno.

Fix $NetBSD$ keyword

return from an SIGFPE handler is not defined when the hardware
caused the exception. Use sigsetjmp/siglongjmp to resume the
test function instead.

Do use integer arithmetics to generate FPE_INTDIV in sigfpe_int testcase.

Ok pgoyette.

Re-enable printing of MD data, with appropriate casts.

For now, don't try to print out machine-dependant stuff. When I figure
out what the right format strings are, I'll re-enable it.

Move the siginfo tests from regress to atf. While here, add a new test
for PR/43655.

XXX The sigchild_dump test currently fails when execute under atf-run.
XXX It does not fail when executed directly from the shell, so there's
XXX something in atf that prevents the child process from dumping.

tests/lib/libc/gen/t_sleep: Sprinkle a few more diagnostics.

PR misc/59254: tests/lib/libc/gen/t_sleep:kevent: intermittent failures

tests/lib/libc/gen/t_sleep: Sprinkle diagnostics.

PR misc/59254: tests/lib/libc/gen/t_sleep:kevent: intermittent failures

tests/lib/libc/gen/t_sleep: Nix trailing whitespace.

No functional change intended.

Preparation for:

misc/59254: tests/lib/libc/gen/t_sleep:kevent: intermittent failures

branches: 1.11.26;
remove duplicate include.

(also move so it is alphabetical, hence the weird diff)

PR/51811: Ngie Cooper: Fix include file portability.

Correct use of incorrect errno - should have no real practical effect.

branches: 1.8.6;
space after comma

branches: 1.7.4;
easier way to find if we are on qemu.

Do not special-case qemu when expecting the failure due to PR kern/43997.

I am sporadically observing this in my real machine as well. It's harder
to trigger, but it happens.

branches: 1.5.2; 1.5.4;
More clean-up, and adjust timing of kevent test to avoid issues with
PR kern/43887

Remove unnecessary header file and an unused variable.
Adjust timing parameters to reduce overall elapsed time, and document
the parameters.
Clean-up status handling for kevent test.
Deal with QEMU timer-related issues (PR-43997).

Provide clear explanation of test-case failures.

Remove a debug printf(), and fix the format in another.

Should resolve build break.

Convert old src/regress/timer&waiter tests to ATF

Verify that PR lib/55041 is no longer an issue.

Move the references to PRs from code comments to the test description. Once
ATF has the ability to output the metadata in the HTML reports, it should be
easy to traverse between releng and gnats -reports via links.

branches: 1.1.2;
Move 't_syslog_pthread' to 't_syslog' for consistency with libc.

Move 't_syslog_pthread' to 't_syslog' for consistency with libc.

Rename some test case names for consistency. No functional change.

Test is no longer expected to hang.

PR lib/44248 closed when test associate with PR fails ==> brick dholland

Add an isolated test case for PR lib/44248.

PR/51812: Ngie Cooper: According to ToG gettimeofday() needs <sys/time.h>

branches: 1.3.2;
PR misc/49342 fix issue where time can tick during tests

Note there are still potential issues as the clock being tested is not
monotonic but it should now not fail unless time is being adjusted.

Fix wrong format string.

branches: 1.1.2;
Few naive checks for time(3).

branches: 1.1.4;
Add basic tests for timespec_get(3), timespec_getres(3)

PR standards/58608

PR/51813: Ngie Cooper: don't leak fd :ttyname_err

branches: 1.3.26;
Test also ttyname_r(3).

Adjust the test with stdin(3).

Add simple test cases for ttyname(3), strtod(3), and getgrent(3).

vis(3): Fix one more buffer overrun in an edge case.

PR lib/57573

XXX pullup-10
XXX pullup-9
XXX pullup-8

vis(3): Fix main part of PR lib/57573.

From Kyle Evans <kevans@FreeBSD.org>.

XXX pullup-10
XXX pullup-9
XXX pullup-8

vis(3) tests: Test another overflow edge case.

Related to PR lib/57573.

XXX pullup-10
XXX pullup-9
XXX pullup-8

vis(3) tests: Expand tests and diagnostic outputs on failure.

PR lib/57573

XXX pullup-10
XXX pullup-9
XXX pullup-8

vis(3) tests: Add xfail test for encoding overflow.

From Kyle Evans <kevans@FreeBSD.org>.

PR lib/57573

XXX pullup-10
XXX pullup-9
XXX pullup-8

branches: 1.9.6; 1.9.16; 1.9.24;
PR/51806: Ngie Cooper: Only run the vis locale test if VIS_NOLOCALE is defined

branches: 1.8.2;
Add a VIS_NOLOCALE test

add null and empty tests.

- check the results of the vis functions
- zero output to make sure things work
- don't use encodings that don't work
- fix the style on decoding

check the results of encoding and decoding

branches: 1.4.6;
add tests for \x and \xx

branches: 1.3.2;
Move 't_syslog_pthread' to 't_syslog' for consistency with libc.

Fix various vis/unvis issues:
- no need for all the weak symbols
- define a new _VIS_END flag for UNVIS_END so that there are no collisions
between and vis and unvis flags.
- add bound versions of the vis and unvis functions that take the length of
the destination buffer. Unlike the OpenBSD ones they return -1 or NULL if
the buffer is not large enough, instead of silently truncating.

Migrate the remaining libc/gen tests to atf

branches: 1.1.2; 1.1.4; 1.1.8;
Minimal execve(2) ATF test.

execve(2), posix_spawn(2): Don't flush _all_ pending signals.

We need only flush those pending signals whose dispositions have been
reset to the default action when that action is to ignore them --
e.g., if the parent had a signal handler function for SIGCHLD or
SIGWINCH, this is reset to the default disposition, which is to
ignore the signal, so any pending SIGCHLD or SIGWINCH need to be
flushed.

And we have logic to do this already in execsigs(9), via
sigclearset(9), which clears the specified set of signals:

402 sigemptyset(&tset);
403 for (signo = 1; signo < NSIG; signo++) {
404 if (sigismember(&p->p_sigctx.ps_sigcatch, signo)) {
405 prop = sigprop[signo];
406 if (prop & SA_IGNORE) {
407 if ((prop & SA_CONT) == 0)
408 sigaddset(&p->p_sigctx.ps_sigignore,
409 signo);
410 sigaddset(&tset, signo);
411 }
412 SIGACTION_PS(ps, signo).sa_handler = SIG_DFL;
...
420 sigclearall(p, &tset, &kq);

https://nxr.netbsd.org/xref/src/sys/kern/kern_sig.c?r=1.409#394

But back in 2003, when ksiginfo_t was introduced, before that logic
was written, we sprouted an exithook to clear _all_ the signals (and,
more importantly for the time, free the ksiginfo_t records to avoid
leaking memory) -- and we wired it up as an _exechook_ too:

+/*
+ * free all pending ksiginfo on exit
+ */
+static void
+ksiginfo_exithook(struct proc *p, void *v)
+{
+ ksiginfo_t *ksi, *hp = p->p_sigctx.ps_siginfo;
+
+ if (hp == NULL)
+ return;
+ for (;;) {
+ pool_put(&ksiginfo_pool, ksi);
+ if ((ksi = ksi->ksi_next) == hp)
+ break;
+ }
+}
...
+ exithook_establish(ksiginfo_exithook, NULL);
+ exechook_establish(ksiginfo_exithook, NULL);

https://mail-index.netbsd.org/source-changes/2003/09/14/msg133910.html

(The first iteration of ksiginfo_exithook had another bug, of course!
But it was soon fixed; that's not the issue here.)

Later, during the newlock2 branch, sigclearall got added for execsigs
to free only the ksiginfo_t records for those signals whose
disposition is being reset to a default action of ignoring the
signal:

void
execsigs(struct proc *p)
{
...
+ sigset_t tset;
...
- for (signum = 1; signum < NSIG; signum++) {
- if (sigismember(&p->p_sigctx.ps_sigcatch, signum)) {
- prop = sigprop[signum];
+ sigemptyset(&tset);
+ for (signo = 1; signo < NSIG; signo++) {
+ if (sigismember(&p->p_sigctx.ps_sigcatch, signo)) {
+ prop = sigprop[signo];
if (prop & SA_IGNORE) {
if ((prop & SA_CONT) == 0)
sigaddset(&p->p_sigctx.ps_sigignore,
- signum);
- sigdelset(&p->p_sigctx.ps_siglist, signum);
+ signo);
+ sigaddset(&tset, signo);
...
}
+ sigclearall(p, &tset);

https://mail-index.netbsd.org/source-changes/2006/10/21/msg176390.html

And the _exithook_ was removed somewhere along the way in the
newlock2 branch (in favour of simply calling sigclearall in exit1),
but the _exechook_ remained:

-static void ksiginfo_exithook(struct proc *, void *);
+static void ksiginfo_exechook(struct proc *, void *);
...
- exithook_establish(ksiginfo_exithook, NULL);
- exechook_establish(ksiginfo_exithook, NULL);
+ exechook_establish(ksiginfo_exechook, NULL);
...
/*
- * ksiginfo_exithook:
+ * ksiginfo_exechook:
*
- * Free all pending ksiginfo entries from a process on exit.
+ * Free all pending ksiginfo entries from a process on exec.
* Additionally, drain any unused ksiginfo structures in the
* system back to the pool.
+ *
+ * XXX This should not be a hook, every process has signals.
*/
static void
-ksiginfo_exithook(struct proc *p, void *v)
+ksiginfo_exechook(struct proc *p, void *v)
{

https://mail-index.netbsd.org/source-changes/2007/02/05/msg180796.html

The symptom of this mistake is that a signal delivered _during_
execve(2) may be simply discarded, even if it should be caught and
cause the process to terminate.

On the bright side, isn't it a nice feeling when you can solve
problems by commits that consist exclusively of deletions?

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

execve(2), posix_spawn(2): Add test case for an embarrassing bug.

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

branches: 1.2.28;
make error more informative.

branches: 1.1.2; 1.1.4; 1.1.8;
Minimal execve(2) ATF test.

Fix linking for multi-source file tests, the second part of the tuple
needs to be the C source file (not the base name)

new tests for posix_spawn_chdir from Piyush Sachdeva

branches: 1.2.4;
Add a few more posix_spawn testcases, which should detect everything that
was wrong in the initial version, causing the failure reported in
PR kern/45991.

Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

branches: 1.1.4;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

tests/lib/libc/gen/posix_spawn: Spruce up a bit.

- KNF
- Don't touch files outside the test working directory.
- No need to pre-clean files -- atf gives us an empty tempdir.
- Use h_macros.h to simplify a lot of checks.
- Use names for enumerated arguments, not magic numbers.
- Check some more syscalls.
- Add include guard.

branches: 1.1.4;
new tests for posix_spawn_chdir from Piyush Sachdeva

tests/lib/libc/gen/posix_spawn: Spruce up a bit.

- KNF
- Don't touch files outside the test working directory.
- No need to pre-clean files -- atf gives us an empty tempdir.
- Use h_macros.h to simplify a lot of checks.
- Use names for enumerated arguments, not magic numbers.
- Check some more syscalls.
- Add include guard.

branches: 1.1.4;
new tests for posix_spawn_chdir from Piyush Sachdeva

new tests for posix_spawn_chdir from Piyush Sachdeva

branches: 1.1.4;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

branches: 1.1.4;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

new tests for posix_spawn_chdir from Piyush Sachdeva

Add test for POSIX_SPAWN_RESETIDS flag

branches: 1.1.4;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

new tests for posix_spawn_chdir from Piyush Sachdeva

fix mainly same typos as in my previous commit but outside sys/dev/dm.

branches: 1.1.4;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

t_fileactions.c: fix typos in comments

In the test code for PR 59523 move the redirect of stdout to the end of
the fileactions, to avoid any interference with the assumptions of the
test-relevant file actions.
We can not guarantee anny of this anyway (but it did trigger the original
problem and both paths in the kernel before the bug was fixed).
Pointed out by kre.

Add two test cases triggereing the two paths in posix_spawn
that cause PR 59523.

tests/lib/libc/gen/posix_spawn: Spruce up a bit.

- KNF
- Don't touch files outside the test working directory.
- No need to pre-clean files -- atf gives us an empty tempdir.
- Use h_macros.h to simplify a lot of checks.
- Use names for enumerated arguments, not magic numbers.
- Check some more syscalls.
- Add include guard.

branches: 1.7.4;
new tests for posix_spawn_chdir from Piyush Sachdeva

more tests needing <sys/stat.h>

branches: 1.5.2; 1.5.16;
Fix asynchronous posix_spawn child exit status (and test for it).

Rework posix_spawn locking and memory management:
- always provide a vmspace for the new proc, initially borrowing from proc0
(this part fixes PR 46286)
- increase parallelism between parent and child if arguments allow this,
avoiding a potential deadlock on exec_lock
- add a new flag for userland to request old (lockstepped) behaviour for
better error reporting
- adapt test cases to the previous two and add a new variant to test the
diagnostics flag
- fix a few memory (and lock) leaks
- provide netbsd32 compat

Add a test case to call posix_spawn with empty file actions, which reproduced
the (now fixed) PR kern/46038.

branches: 1.2.2;
Add a few more posix_spawn testcases, which should detect everything that
was wrong in the initial version, causing the failure reported in
PR kern/45991.

Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

tests/lib/libc/gen/posix_spawn: Spruce up a bit.

- KNF
- Don't touch files outside the test working directory.
- No need to pre-clean files -- atf gives us an empty tempdir.
- Use h_macros.h to simplify a lot of checks.
- Use names for enumerated arguments, not magic numbers.
- Check some more syscalls.
- Add include guard.

t_spawn: Add missing dup2 in t_spawn_sig.

Matches what h_execsig expects, and what t_execve_sig arranges: stdin
is a pipe that the parent will write a single byte to after it has
delivered SIGTERM.

Now this should have a higher chance of provoking the bug (though it
was already good enough in cursory testing!).

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

execve(2), posix_spawn(2): Don't flush _all_ pending signals.

We need only flush those pending signals whose dispositions have been
reset to the default action when that action is to ignore them --
e.g., if the parent had a signal handler function for SIGCHLD or
SIGWINCH, this is reset to the default disposition, which is to
ignore the signal, so any pending SIGCHLD or SIGWINCH need to be
flushed.

And we have logic to do this already in execsigs(9), via
sigclearset(9), which clears the specified set of signals:

402 sigemptyset(&tset);
403 for (signo = 1; signo < NSIG; signo++) {
404 if (sigismember(&p->p_sigctx.ps_sigcatch, signo)) {
405 prop = sigprop[signo];
406 if (prop & SA_IGNORE) {
407 if ((prop & SA_CONT) == 0)
408 sigaddset(&p->p_sigctx.ps_sigignore,
409 signo);
410 sigaddset(&tset, signo);
411 }
412 SIGACTION_PS(ps, signo).sa_handler = SIG_DFL;
...
420 sigclearall(p, &tset, &kq);

https://nxr.netbsd.org/xref/src/sys/kern/kern_sig.c?r=1.409#394

But back in 2003, when ksiginfo_t was introduced, before that logic
was written, we sprouted an exithook to clear _all_ the signals (and,
more importantly for the time, free the ksiginfo_t records to avoid
leaking memory) -- and we wired it up as an _exechook_ too:

+/*
+ * free all pending ksiginfo on exit
+ */
+static void
+ksiginfo_exithook(struct proc *p, void *v)
+{
+ ksiginfo_t *ksi, *hp = p->p_sigctx.ps_siginfo;
+
+ if (hp == NULL)
+ return;
+ for (;;) {
+ pool_put(&ksiginfo_pool, ksi);
+ if ((ksi = ksi->ksi_next) == hp)
+ break;
+ }
+}
...
+ exithook_establish(ksiginfo_exithook, NULL);
+ exechook_establish(ksiginfo_exithook, NULL);

https://mail-index.netbsd.org/source-changes/2003/09/14/msg133910.html

(The first iteration of ksiginfo_exithook had another bug, of course!
But it was soon fixed; that's not the issue here.)

Later, during the newlock2 branch, sigclearall got added for execsigs
to free only the ksiginfo_t records for those signals whose
disposition is being reset to a default action of ignoring the
signal:

void
execsigs(struct proc *p)
{
...
+ sigset_t tset;
...
- for (signum = 1; signum < NSIG; signum++) {
- if (sigismember(&p->p_sigctx.ps_sigcatch, signum)) {
- prop = sigprop[signum];
+ sigemptyset(&tset);
+ for (signo = 1; signo < NSIG; signo++) {
+ if (sigismember(&p->p_sigctx.ps_sigcatch, signo)) {
+ prop = sigprop[signo];
if (prop & SA_IGNORE) {
if ((prop & SA_CONT) == 0)
sigaddset(&p->p_sigctx.ps_sigignore,
- signum);
- sigdelset(&p->p_sigctx.ps_siglist, signum);
+ signo);
+ sigaddset(&tset, signo);
...
}
+ sigclearall(p, &tset);

https://mail-index.netbsd.org/source-changes/2006/10/21/msg176390.html

And the _exithook_ was removed somewhere along the way in the
newlock2 branch (in favour of simply calling sigclearall in exit1),
but the _exechook_ remained:

-static void ksiginfo_exithook(struct proc *, void *);
+static void ksiginfo_exechook(struct proc *, void *);
...
- exithook_establish(ksiginfo_exithook, NULL);
- exechook_establish(ksiginfo_exithook, NULL);
+ exechook_establish(ksiginfo_exechook, NULL);
...
/*
- * ksiginfo_exithook:
+ * ksiginfo_exechook:
*
- * Free all pending ksiginfo entries from a process on exit.
+ * Free all pending ksiginfo entries from a process on exec.
* Additionally, drain any unused ksiginfo structures in the
* system back to the pool.
+ *
+ * XXX This should not be a hook, every process has signals.
*/
static void
-ksiginfo_exithook(struct proc *p, void *v)
+ksiginfo_exechook(struct proc *p, void *v)
{

https://mail-index.netbsd.org/source-changes/2007/02/05/msg180796.html

The symptom of this mistake is that a signal delivered _during_
execve(2) may be simply discarded, even if it should be caught and
cause the process to terminate.

On the bright side, isn't it a nice feeling when you can solve
problems by commits that consist exclusively of deletions?

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

execve(2), posix_spawn(2): Add test case for an embarrassing bug.

PR kern/58091: after fork/execve or posix_spawn, parent kill(child,
SIGTERM) has race condition making it unreliable

branches: 1.8.4;
s/disbale/disable/ and s/enbale/enable/ in comments. also one more typo fix.

undef a couple more.

Merge common code for the chdir cases (Piyush Sachdeva)
I also deduplicated some more code

Add missing test

new tests for posix_spawn_chdir from Piyush Sachdeva

s/existant/existent/ in comments and messages, plus few more similar fixes.

src is too big these days to tolerate superfluous apostrophes. It's
"its", people!

branches: 1.1.4;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng

tests/lib/libc/gen/posix_spawn: Spruce up a bit.

- KNF
- Don't touch files outside the test working directory.
- No need to pre-clean files -- atf gives us an empty tempdir.
- Use h_macros.h to simplify a lot of checks.
- Use names for enumerated arguments, not magic numbers.
- Check some more syscalls.
- Add include guard.

branches: 1.6.4;
s/controll/control/ in comments.

new tests for posix_spawn_chdir from Piyush Sachdeva

Add test for POSIX_SPAWN_RESETIDS flag

Fix broken test: we can't assume that the current schedule priority range
will overlap with the requested scheduler range, so get the new scheduler
range, and then try to find a different priority. If that fails (to find
a different scheduling range), give up here.

Don't use SCHED_OTHER.

branches: 1.1.4; 1.1.34;
Move posix_spawn tests to lib/libc/gen/posix_spawn - they test both libc
and kernel, but that is an implementation detail unrelated to the tests
themselfs.
Ok: releng