Several standard library functions are specified to return an unqualified
pointer while accepting a pointer to a potentially const-qualified object.
N3020 addresses this behaviour, discarding qualifiers due to incompatible
pointer types, by introducing qualifier-preserving macros for the affected
set of standard library functions.
Add `__qualsel()` helper to `<sys/cdefs.h>`, implemented using the generic
selection, and define qualifier-preserving macros for that set of functions
in `<string.h>`, `<wchar.h>`, and `<stdlib.h>`.
Macros are gated on `_STDC_VERSION__ >= 202311L && !__cplusplus`, therefore
there is no behavioural change for earlier C modes or C++ translation units.
The kernel is likewise unaffected, as it does not include userland headers.
As function-like macros, they are transparent except at a call site where
the address-of operator is applied, the macro is suppressed via `#undef`,
or the identifier appears in parenthesised form; all of which cause the
underlying function designator to be used instead.
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 month
Pull Request: https://github.com/freebsd/freebsd-src/pull/2288
Add BOOL_MAX and BITINT_MAXWIDTH macros for C23 compliance, and
define the __STDC_VERSION_LIMITS_H__ feature test macro now that
the header fully conforms to C23.
Reviewed by: fuz
Approved by: fuz (mentor)
MFC after: 1 month
Pull Request: https://github.com/freebsd/freebsd-src/pull/2352
Previously fts_build() called _dup(_dirfd(dirp)) for every child
entry, holding N simultaneous fds for a directory with N children.
Redefine fts_dirfd: instead of a fd for the entry's parent
directory, it is now a fd for the entry itself, set only for
directory entries. One dup per directory in fts_build() instead
of one per child. Close fts_dirfd during the directory post-order
visit, before advancing to its sibling.
To access a file using fd-relative operations, callers should use
openat(ent->fts_parent->fts_dirfd, ent->fts_name, ...) instead of
openat(ent->fts_dirfd, ent->fts_name, ...). The fd is valid until the
directory's post-order visit (FTS_DP).
Reported by: Mark Johnston <[email protected]>
Fixes: 4bd01d6ae0 (fts: refactor to use fd-relative operations)
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2360
Replace all _open() calls with _openat() in __fts_open(), fts_read(),
and fts_children(). Replace statfs() with _fstatfs().
Add fts_dirfd to struct _ftsent, set to the file descriptor of the
parent directory. Callers can use openat(ent->fts_dirfd, ent->fts_name,
...) to access files safely without relying on fts_accpath, which
enables programs in capability mode to open the files described by
_ftsent.
This is a preparatory change for fts_openat() which will allow callers
to provide a pre-opened directory fd, enabling fts(3) traversal inside
Capsicum capability mode.
Mirror all fts_open() changes to fts_open_b().
As a result of expanding _ftsend, publish new ELF symbol versions for
fts_openat and related functions.
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers
Pull Request: https://github.com/freebsd/freebsd-src/pull/2303
strfromd(), strfromf(), and strfroml() are implemented directly
in terms of gdtoa. If a non-conforming format string is passed,
the string "EDOOFUS" is returned and errno set to EDOOFUS as an
extension.
Reviewed by: fuz
MFC after: 1 month
Pull-Request: https://github.com/freebsd/freebsd-src/pull/2301
Signed-off-by: Faraz Vahedi <[email protected]>
This reverts commit e03ed9daeb.
The change to the size of struct FTSENT is breaking backwards
compatibility for some binaries. Jitendra is working on a new version
that will move the new field into a private struct.
Reported by: bdrewery
Fixes: e03ed9daeb ("fts: refactor to use fd-relative operations")
Sponsored by: ConnectWise
Replace all _open() calls with _openat() in __fts_open(), fts_read(),
and fts_children().
Add fts_dirfd to FTSENT. Callers can use
openat(ent->fts_dirfd, ent->fts_name, ...) to access files
safely without relying on fts_accpath, which enables:
1. Capsicum capability mode where path-based operations fail
2. Security-sensitive programs that avoid TOCTOU races
Replace statfs(ent->fts_path) with _fstatfs(ent->fts_dirfd) in
fts_ufslinks() when fts_dirfd is valid, falling back to statfs() for
root-level entries where fts_dirfd is -1
This is a preparatory change for fts_openat() which will allow
callers to provide a pre-opened directory fd, enabling fts(3)
traversal inside Capsicum capability mode.
Sponsored by: Google LLC (GSoC 2026)
Reviewed by: asomers, jillest
MFC after: 2 weeks
Pull Request: https://github.com/freebsd/freebsd-src/pull/2278
Replace the `(bool(*)(bool))` probe in `__assert_sanitize()` with an unevaluated
conditional expression, so types with `explicit operator bool()` that require a
contextually converted constant expression of type `bool` are handled correctly.
Ergo, arity check is now performed separately via `__assert_sanitize_arity()`, a
unary template whose parameter pack must bind to exactly on argument after
`__VA_ARGS__` is substituted into the call.
Also align NDEBUG with C23 requirements.
Reported by: dim, aokblast
Signed-off-by: Faraz Vahedi <[email protected]>
Reviewed by: aokblast, fuz
MFC after: 1 week
Fixes: 867b51452e
Pull Request: https://github.com/freebsd/freebsd-src/pull/2265
Add C23 sized deallocation entry points as thin wrappers around free(3).
Implementations may ignore size and alignment hints, so behaviour stays
correct for existing allocations without validating caller metadata yet.
When jemalloc is updated to 5.3.1, rewire these to je_free_sized() and
je_free_aligned_sized() so deallocation can use the allocator's sized
deallocation (free_sized for fast paths and free_aligned_sized for
correct aligned hints.)
Please note this change satisfies the standard interface only. Both
functions should be delegated to jemalloc after the upgrade so callers
get the intended allocator behaviour; until then, hints are unused and
neither sized nor aligned-sized deallocation optimizations apply.
Signed-off-by: Faraz Vahedi <[email protected]>
Reviewed by: fuz
Pull Request: https://github.com/freebsd/freebsd-src/pull/2201
MFC after: 1 month
style(9) still allows TAB after #define but this is a historical
artifact and by far the minority of uses cases. Going forward, we would
like to promote the use of a single space, as it allows alignment to
survive line prefixing (such as in diffs).
style(9) also has prescribed a single space between '#else' or '#endif'
and a comment recalling the guard since 2002.
So, commit 157c184689 ("assert.h: Remove leading tabs for whitespace
consistency") was good, and in line with rules about whitespace changes
(since the file was heavily modified by surrounding commits).
This commit is thus basically a revert of 439710cf00 ("assert.h:
Revert "Remove leading tabs for whitespace consistency"), which extended
replacing spaces with TABs in the code introduced in the meantime (after
commit 157c184689).
Reviewed by: fuz, imp
Fixes: 439710cf00 ("assert.h: Revert "Remove leading tabs for whitespace consistency")
MAC after: 3 days
Differential Revision: https://reviews.freebsd.org/D57391
`yp_prot.h` has carried a SunRPC-era typedef of `bool` guarded by
`BOOL_DEFINED`, but the header itself does not use it. The YP/RPC
interfaces use `bool_t` for protocol booleans.
Defining `bool` in a public header collides with modern C headers
that provide `bool` as a macro or keyword, such as `<stdbool.h>`
and C23-aware assert handling. Drop the compatibility typedef and
leave `bool` definition to the consumer's language mode.
Signed-off-by: Faraz Vahedi <[email protected]>
Reviewed by: fuz
MFC after: 1 month
Pull Request: https://github.com/freebsd/freebsd-src/pull/2203
Previous script called acpiconf(8) (or apm(8) if ACPI wasn't supported,
although this was anyway redundant because APMIO just uses ACPI now).
Since a new generic power management interface was introduced, this isn't
sufficient, as this would only work for ACPI systems and for ACPI S3 suspend
(so no way to select suspend-to-idle). Rewrite in C to take advantage of the
new power interface.
We may want to add a switch to manually override the kern.power.suspend sysctl,
which is otherwise what the power device uses to decide which suspend type to
switch to (suspend-to-idle or firmware suspend), but this will require us to
amend the power interface.
Reviewed by: olce, imp, mhorne, ziaee
Tested by: mhorne
Approved by: olce, imp, mhorne, ziaee
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D56918
Sorry for the mess.
Revert "sys/vnode.h: remove stale comment"
This reverts commit f193f5a749.
Revert "vfs: convert VFS_OPs from macros to static inlines"
This reverts commit 48bf024f2e.
Revert "vnode: add VIRF_KNOTE flag"
This reverts commit 7fe74a0276.
Revert "vfs: convert vfs_op_thread_* macros to static inlines"
This reverts commit a61a696e78.
Revert "struct vnode: assign v_rl.resv1 as v_vrflag"
This reverts commit d990e8f0e9.
Revert "sys/rangelock.h: explicitly enumerate padding at the end of the structure"
This reverts commit a770638ecf.
Revert "bufspace_wait(): only try to help bufdaemon if there is a chance to help"
This reverts commit 067cfac2e7.
Revert "Add O_SYMLINK emulation"
This reverts commit f9458655e7.
Revert "libc: add freadlink(3)"
This reverts commit ae6a13deb8.
Revert "Add O_SYMLINK emulation"
This reverts commit 2213820b6f.
The getgroups test is a NetBSD tests, so just apply our larger hammer
and disable the feature entirely. The audit test can take a more
surgical approach and use __ssp_real() appropriately, since it's a local
one.
PR: 294881
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56735
Annex K specifies an interface for handling constraint violations from
gets_s, but we previously broke this for some classes of get_s misuse.
Provide a more nuanced version that tries to dodge errors that would
trigger a constraint handler while still providing value. Notably, we
don't want to trigger a failure unless the passed-in length reasonably
fits within an RSIZE_MAX, because gets_s will immediately call larger
lengths bogus and fail.
PR: 294881
Reviewed by: markj
Differential Revision: https://reviews.freebsd.org/D56734
These are required by ISO/IEC 9899:2024 § 7.18.1 ¶ 1 but were forgotten
in my initial work.
The current approach leaks intptr_t, uintptr_t, intmax_t, and uintmax_t
through <sys/_stdint.h>. This could be avoided using a more complicated
approach if desired.
PR: 294131
Fixes: 6296500a85
Reported by: Collin Funk <[email protected]>
Reviewed by: imp
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D56515
Move to sys/_offsetof.h and use __builtin_offsetof() instead of
__offsetof to avoid reintroducing sys/cdefs.h polution in stddef.h.
This has the side effect of allowing sys/stddef.h to be included after
stddef.h which can happen in compatability headers.
Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL
Reviewed by: imp, kib
Differential Revision: https://reviews.freebsd.org/D55307
I'd missed that stddef.h is standalone and isn't a copy of sys/stddef.h
in my initial merge.
Effort: CHERI upstreaming
Reviewed by: kib
Sponsored by: Innovate UK
Fixes: dca634d154 ("new type: ptraddr_t")
Differential Revision: https://reviews.freebsd.org/D55305
Include sys/types.h by exterr.h, since size_t is used.
Drop include of sys/exterr_cat.h, it is useless for the only prototype
provided.
Reviewed by: mckusick
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D55337
It takes exactly three arguments of known type.
Tweak the types of various resultproc_t functions to match the type (mostly
added const to struct pointers) allowing us to drop casts.
Effort: CHERI upstreaming
Reviewed by: vangyzen, glebius
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D54941
The `eachresult` argument is documented to take a function pointer of
type:
bool_t (*)(caddr_t, struct sockaddr_in *)
It was declared to take a resultproc_t which has historically been
declared to be:
bool_t (*resultproc_t)(caddr_t, ...);
This overlapped well enough for currently supported ABIs where variadic
arguments are passed in registers, but this declaration is misaligned
with the documentation (resultproc_t takes three arguments) and will be
fixed in a followup commit.
Fix the type to be non-variadic, matching callbacks, and define a
convenience type of as most callbacks take something other than a char *
as their first argument and need to be cast.
Effort: CHERI upstreaming
Reviewed by: ngie, glebius, jhb
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D54940
If execfd is set, the fexecve(2) is used by posix_spawn() instead of the
provided path.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D54862
The type of xdrproc_t is clearly defined in the comments as a function
with two arguments, an XDR * and a void * (sometimes spelled caddr_t).
It was initialy defined as:
typedef bool_t (*xdrproc_t)();
At some point people started giving it a non-empty argument list.
Unfortunatly, there has been widespread disagreement about how arguments
are passed. There seems to have been a widespread view that it should
be allowed to pass three argument function pointer to xdrproc_t. Most
notable is xdr_string which takes a maximum length parameter. This lead
to all sorts of prototypes (all of which have been present in the
FreeBSD source tree):
FreeBSD userspace (nominally from tirpc, but seemingly local):
typedef bool_t (*xdrproc_t)(XDR *, ...);
FreeBSD kernel, glibc:
typedef bool_t (*xdrproc_t)(XDR *, void *, ...);
rcp/xdr.h with _KERNEL defined (not used?):
typedef bool_t (*xdrproc_t)(XDR *, void *, u_int);
gssrpc (in krb5) and Linux kernel:
typedef bool_t (*xdrproc_t)(XDR *, void *);
For two argument functions on current ABIs, these all equivalent as
these arguments are passed in registers regardless of decleration and
definition, but we end up with two problems:
- xdr_free((xdrproc_t)xdr_string, ...) calls xdr_string with no third
argument and (at least on FreeBSD) may fail to free memory if the
string is shorter than the value lying around in the third argument
register. There are no instance of this in tree, but I found some
with Debian code search, in particular in OpenAFS.
- Under CheriABI, variadic arguments are passed in a separate,
bounded array so theses prototypes aren't equilvalent to the
non-variadic calling convention of the functions.
The reality is that that xdr_string should not be cast to xdrproc_t and
xdr_wrapstring should be used instead so we do not need to support this
case. Instances of the former behavior are now extremely rare.
With this change we bring FreeBSD in line with gssrpc and the Linux
Kernel. Warnings about casts should now be correct and should be fixed.
Bump __FreeBSD_version as some software required adaptation if it is
declaring functions to cast to xdrproc_t. Update OpenZFS's workaround
of this historic mess accordingly.
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D54824
Similar to the same glibc function.
Reviewed by: markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D54766
Add strtonumx(), a companion to strtonum(3) that preserves its safety
and error-reporting semantics while allowing the caller to specify a
conversion base, similar to the strtol(3) family of functions.
Reviewed by: emaste, kib, ziaee
Obtained from: https://www.illumos.org/issues/15365
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D54270
When a compiler with C23 or higher is detected, builtin bool, true,
and false are used to conform the C23 standard.
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D44664
Define _ALIGNBYTES using sizeof(void *) (no functional change on any
existing architecture) which will allow it to work with CHERI were we
must align things up to capability alignment.
In _ALIGN, replace integer manipulation which does not preserve pointer
provenance with a type and provenance preserving builtin. This requires
modest changes in code which assumes _ALIGN returns an integer, but
those are relatively rare.
Reviewed by: kib, markj
Effort: CHERI upstreaming
Sponsored by: Innovate UK
Differential Revision: https://reviews.freebsd.org/D53947
Faraz Vahedi