stdlib.h: Partially revert c27a89971805

quick_exit() can call other functions, and we don't guarantee it calls
std::terminate should those other functions throw exceptions. And to
make it do so has ABI complications for libc. Until that's sorted out,
revert this noexcept (but leave a comment behind so people will find
this commit message)

Requested by: kib

Sponsored by: Netflix

stdlib.h: add __noexcept to prototypes

The noexcept specifier is required on these functions in C++:
_Exit(), atexit(), quick_exit(), at_quick_exit(), abort().

MFC after: 2 weeks

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1085

include: Remove ancient SCCS tags.

Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl script.

Sponsored by: Netflix

Remove $FreeBSD$: one-line .h pattern

Remove /^\s*\*+\s*\$FreeBSD\$.*$\n/

Revert "libc: Implement bsort(3) a bitonic type of sorting algorithm."

Some points for the future:
- libc is not the right place for sorting algorithms.
Probably libutil is better suited for this purpose or
a dedicated libsort. Should move all sorting algorithms
away from libc eventually.
- CheriBSD uses capabilities for memory access, and could
benefit from a standard memswap() function.
- Do something about qsort() in FreeBSD's libc like:
- Mark it deprecated on FreeBSD, as a first step,
due to missing limits on CPU time.
- Audit the use of qsort() in the FreeBSD base system
and consider swapping to other existing sorting
algorithms.

Discussed with: brooks@

Differential Revision: https://reviews.freebsd.org/D36493

This reverts commit a7469c9c0a504a5e6e9b89e148cd78df5e67ff7f.
This reverts commit 7d65a450cdcc7cc743f2ecd114ba3428a21c0033.
This reverts commit 8dcf3a82c54cb216df3213a013047907636a01da.

libc: bsort_s() requires both __BSD_VISIBLE and __EXT1_VISIBLE

Fixes build of Python:
/usr/include/stdlib.h:409:1: error: unknown type name 'errno_t'
errno_t bsort_s(void *, rsize_t, rsize_t,

Reported by: vishwin@
MFC after: 1 week
Sponsored by: NVIDIA Networking
Differential Revision: https://reviews.freebsd.org/D36493

libc: Implement bsort(3) a bitonic type of sorting algorithm.

The bsort(3) algorithm works by swapping objects, similarly to qsort(3),
and does not require any significant amount of additional memory.

The bsort(3) algorithm doesn't suffer from the processing time issues
known the plague the qsort(3) family of algorithms, and is bounded by
a complexity of O(log2(N) * log2(N) * N), where N is the number of
elements in the sorting array. The additional complexity compared to
mergesort(3) is a fair tradeoff in situations where no memory may
be allocated.

The bsort(3) APIs are identical to those of qsort(3), allowing for
easy drop-in and testing.

The design of the bsort(3) algorithm allows for future parallell CPU
execution when sorting arrays. The current version of the bsort(3)
algorithm is single threaded. This is possible because fixed areas
of the sorting data is compared at a time, and can easily be divided
among different CPU's to sort large arrays faster.

Reviewed by: gbe@, delphij@, pauamma_gundo.com (manpages)
Sponsored by: NVIDIA Networking
Differential Revision: https://reviews.freebsd.org/D36493

secure_getenv: Put under __BSD_VISIBLE

Sponsored by: Netflix
Reviewed by: delphij
Differential Revision: https://reviews.freebsd.org/D39076

Add GNU glibc compatible secure_getenv

Add mostly glibc and msl compatible secure_getenv. Return NULL if
issetugid() indicates the process is tainted, otherwise getenv(x). The
rational behind this is the fact that many Linux applications use this
function instead of getenv() as it's widely consider a, "best
practice".

Reviewed by: imp, mjg (feedback)
Pull Request: https://github.com/freebsd/freebsd-src/pull/686
Signed-off-by: Lucy Marsh <seafork@disroot.org>

include: Fix typos

Signed-off-by: Elyes Haouas <ehaouas@noos.fr>

Revert "stdlib.h: Fix qsort_r compatibility with GCC 12."

This reverts commit 43703bc489ec504b947b869045c492ed38c1a69c.

Reviewed by: jrtc27
Differential Revision: https://reviews.freebsd.org/D38216

stdlib.h: Fix qsort_r compatibility with GCC 12.

GCC 12 (unlike GCC 9) does not match a function argument passed to the
old qsort_r() API (as is used in the qsort_r_compat test) to a
function pointer type via __generic. It treats the function type as a
distinct type from a function pointer. As a workaround, add a second
definition of qsort_r for GCC 12 which uses the bare function type.

Reviewed by: emaste
Differential Revision: https://reviews.freebsd.org/D37410

Alter the prototype of qsort_r(3) to match POSIX, which adopted the
glibc-based interface.

Unfortunately, the glibc maintainers, despite knowing the existence
of the FreeBSD qsort_r(3) interface in 2004 and refused to add the
same interface to glibc based on grounds of the lack of standardization
and portability concerns, has decided it was a good idea to introduce
their own qsort_r(3) interface in 2007 as a GNU extension with a
slightly different and incompatible interface.

With the adoption of their interface as POSIX standard, let's switch
to the same prototype, there is no need to remain incompatible.

C++ and C applications written for the historical FreeBSD interface
get source level compatibility when building in C++ mode, or when
building with a C compiler with C11 generics support, provided that
the caller passes a fifth parameter of qsort_r() that exactly matches
the historical FreeBSD comparator function pointer type and does not
redefine the historical qsort_r(3) prototype in their source code.

Symbol versioning is used to keep old binaries working.

MFC: never
Relnotes: yes
Reviewed by: cem, imp, hps, pauamma
Differential revision: https://reviews.freebsd.org/D17083

libc: add clearenv function

The clearenv(3) function allows us to clear all environment
variable in one shot. This may be useful for security programs that
want to control the environment or what variables are passed to new
spawned programs.

Reviewed by: scf, markj (secteam), 0mp (manpages)
Differential Revision: https://reviews.freebsd.org/D28223

Remove obsolete check for GCC < 3 and support for Intel Compiler

We no longer support old versions of GCC. Remove this check by
assuming it's false. That will make the entire expression false. Also
remove support for Intel compiler, it's badly bitrotted. Technically,
this removes support for C89 and K&R from compilers that don't define
_Bool in those compilation environments as well. I'm unaware of any
working compiler today for which that would be relevant (pcc has it
and tcc sadly isn't working for other reasons), though if one
pops up in ports, I'll work to resolve the issue.

Further refinements of ptsname_r(3) interface:

- Hide ptsname_r under __BSD_VISIBLE for now as the specification
is not finalized at this time.
- Keep Symbol.map sorted.
- Avoid the interposing of ptsname_r(3) from an user application
from breaking ptsname(3) by making the implementation a static
method and call the static function from ptsname(3) instead.

Reported by: kib
Reviewed by: kib, jilles
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D26845

Implement ptsname_r.

MFC after: 2 weeks
PR: 250062
Reviewed by: jilles, 0mp, Ray <i maskray me>
Differential Revision: https://reviews.freebsd.org/D26647

rand(3): Replace implementation with one backed by random(3) algorithm

rand(3)'s standard C API is extremely limiting, but we can do better
than the historical 32-bit state Park-Miller LCG we've shipped since
2001: r73156.

The justification provided at the time for not using random(3) was that
rand_r(3) could not be made to use the same algorithm. That is still
true. However, the irrelevance of rand_r(3) is increasingly obvious.
Since that time, POSIX has marked the interface obsolescent. rand_r(3)
never became part of the standard C library. If not for API
compatibility reasons, I would just remove rand_r(3) entirely.

So, I do not believe it is a problem for rand_r(3) and rand(3) to
diverge.

The 12 ABI is maintained with compatibility definitions, but this
revision does subtly change the API of rand(3). The sequences of
pseudorandom numbers produced in programs built against new versions of
libc will differ from programs built against prior versions of libc.

Reviewed by: kevans, markm
MFC after: no
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D23290

Add qsort_s(3). Apart from the constraints, it also makes it easier
to port software written for Linux variant of qsort_r(3).

Reviewed by: kib, arichardson
MFC after: 2 weeks
Relnotes: yes
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D23174

Revert r355760, r355759

And remove the inline/deprecated attribute use entirely in stdlib.h, from
r355747. The intent was to provide a buildable API transitionary period, but
clearly that was counter-productive.

Reported by: delphij, imp, others

cdefs: Add __deprecated(message) function attribute macro

The legacy version of GCC4 currently in base does not support the
parameterized form of this function attribute, as recent introduced in
stdlib.h (r355747).

As we have done for other function attributes with similar compatibility
problems, add a version-compatibile definition in sys/cdefs.h. Note that
Clang defines itself to be GCC 4, so one must check for __clang__ in
addition to __GNUC__ version. On legacy GCC 4, the macro expands to just
the __deprecated__ attribute; on modern GCC or Clang, the macro expands to
the parameterized variant with the message.

Ignoring legacy or unsupported compilers, the macro is also beneficial in
that it is a bit more ergonomic than the full
__attribute__((__deprecated__())) boilerplate.

Reported by: CI (but not tinderbox); imp and others
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D22817

Deprecate sranddev(3) API

It serves no useful purpose and wasn't as popular as its equally meritless
cousin, srandomdev(3).

Setting aside the problems with rand(3) in general, the problem with this
interface is that the seed isn't shared with the caller (other than by
attacking the output of the generator, which is trivial, but not a hallmark of
pleasant API design). The (arguable) utility of rand(3) or random(3) is as a
semi-fast simulation generator which produces consistent results from a given
seed. These are mutually at odd. Furthermore, sometimes people got the
mistaken impression that a high quality random seed meant a weak generator like
rand(3) or random(3) could be used for things like cryptographic key
generation. This is absolutely not so.

The API was never part of a standard and was not widely used in tree. Existing
in-tree uses have all been removed.

Possible replacement in out of tree codebases:

char buf[3];
time_t t;

time(t);
strftime(buf, sizeof(buf), "%S", gmtime(&t));
srand(atoi(buf));

Relnotes: yes

Vendor import of stripped libc++ trunk r366426 (just before the release_90 branch
point):

https://llvm.org/svn/llvm-project/libcxx/trunk@366426

Add mkostempsat(3).

This is a variant of mkostemps() which takes a directory descriptor and
returns a descriptor for a tempfile relative to that directory. Unlike
the other mktemp functions, mkostempsat() can be used in capability
mode.

Reviewed by: cem
Discussed with: brooks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D21031

Remove arc4random_stir and arc4random_addrandom from stdlib.h.
Users of arc4random(3) should never call them directly.

All ports tree usage was fixed as part of bug 230756.

Relnotes: yes
Approved by: re (marius), exp-run (bug 230756 by portmgr antoine)

Update userland arc4random() with OpenBSD's Chacha20 based arc4random().

ObsoleteFiles.inc:

Remove manual pages for arc4random_addrandom(3) and
arc4random_stir(3).

contrib/ntp/lib/isc/random.c:
contrib/ntp/sntp/libevent/evutil_rand.c:

Eliminate in-tree usage of arc4random_addrandom().

crypto/heimdal/lib/roken/rand.c:
crypto/openssh/config.h:

Eliminate in-tree usage of arc4random_stir().

include/stdlib.h:

Remove arc4random_stir() and arc4random_addrandom() prototypes,
provide temporary shims for transistion period.

lib/libc/gen/Makefile.inc:

Hook arc4random-compat.c to build, add hint for Chacha20 source for
kernel, and remove arc4random_addrandom(3) and arc4random_stir(3)
links.

lib/libc/gen/arc4random.c:

Adopt OpenBSD arc4random.c,v 1.54 with bare minimum changes, use the
sys/crypto/chacha20 implementation of keystream.

lib/libc/gen/Symbol.map:

Remove arc4random_stir and arc4random_addrandom interfaces.

lib/libc/gen/arc4random.h:

Adopt OpenBSD arc4random.h,v 1.4 but provide _ARC4_LOCK of our own.

lib/libc/gen/arc4random.3:

Adopt OpenBSD arc4random.3,v 1.35 but keep FreeBSD r114444 and
r118247.

lib/libc/gen/arc4random-compat.c:

Compatibility shims for arc4random_stir and arc4random_addrandom
functions to preserve ABI. Log once when called but do nothing
otherwise.

lib/libc/gen/getentropy.c:
lib/libc/include/libc_private.h:

Fold __arc4_sysctl into getentropy.c (renamed to arnd_sysctl).
Remove from libc_private.h as a result.

sys/crypto/chacha20/chacha.c:
sys/crypto/chacha20/chacha.h:

Make it possible to use the kernel implementation in libc.

PR: 182610
Reviewed by: cem, markm
Obtained from: OpenBSD
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D16760

Use the __alloc_size2 attribute where relevant.

This follows the documented use in GCC. It is basically only relevant for
calloc(3), reallocarray(3) and mallocarray(9).

Suggested by: Mark Millard

Reference:
https://docs.freebsd.org/cgi/mid.cgi?9DE674C6-EAA3-4E8A-906F-446E74D82FC4

Use the __result_use_check attribute also for reallocf(3).

The GCC attribute causes a warning to be emitted if a caller of the
function with this attribute does not use its return value. Unlike the
traditional realloc, with reallocf(3) we don't have to check for NULL
values but we still have to make sure the result is used.

MFC after: 3 days

Introduce the daemonfd function.

The daemonfd function is equivalent to the daemon(3) function expect that
arguments are descriptors. For example dhclient(8) which is sandboxed is
unable to open /dev/null to close stdio instead it's allows to fail
daemon(3) function to close the descriptors and then do it explicit in code.
Instead of such hacks we can use now daemonfd.

This API can be also helpful to migrate system to platforms like CheriBSD.

Reviewed by: brooks@, bcr@, jilles@ (earlier version)
Differential Revision: https://reviews.freebsd.org/D13433

Remove lint support from system headers and MD x86 headers.

Reviewed by: dim, jhb
Discussed with: imp
Sponsored by: The FreeBSD Foundation
Differential revision: https://reviews.freebsd.org/D13156

include: further adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.

Vendor import of libc++ trunk r303197:
https://llvm.org/svn/llvm-project/libcxx/trunk@303197

Implement the memset_s(3) function as specified by the C11 ISO/IEC
9899:2011 Appendix K 3.7.4.1.

Other needed supporting types, defines and constraint_handler
infrastructure is added as specified in the C11 spec.

Submitted by: Tom Rix <trix@juniper.net>
Sponsored by: Juniper Networks
Discussed with: ed
MFC after: 3 weeks
Differential revision: https://reviews.freebsd.org/D9903
Differential revision: https://reviews.freebsd.org/D10161

Remove outdated claim.

Despite wishful thinking the removal of these old function hasn't
happened yet.

MFC after: 3 days

Make use of clang nullability attributes.

Replace uses of the GCC __nonnull__ attribute with the clang nullability
qualifiers. The replacement should be transparent for clang developers as
the new qualifiers will produce the same warnings and will be useful for
static checkers but will not cause aggressive optimizations.

GCC will not produce such warnings and developers will have to use
upgraded GCC ports built with the system headers from r312538.

Hinted by: Apple's Libc-1158.20.4, Bionic libc
MFC after: 11.1 Release

Differential Revision: https://reviews.freebsd.org/D9004

Remove some uses of the GCC __nonnull() attribute.

While the checks are considered useful, the attribute does dangerous
optimizations, removing NULL checks where they can be needed. Remove the
uses of this attribute introduced in r281130: the changes were inspired on
Google's bionic where this attribute is not used anymore.

The __nonnull() attribute will be deprecrated from our headers and
replaced with the Clang _Nonnull qualifier in the future.

MFC after: 3 days

Remove setkey(), encrypt(), des_setkey() and des_cipher().

The setkey() and encrypt() functions are part of XSI, not the POSIX base
definitions. There is no strict requirement for us to provide these,
especially if we're only going to keep these around as undocumented
stubs. The same holds for des_setkey() and des_cipher().

Instead of providing functions that only generate warnings when linking,
simply disallow linking against them. The impact of this is relatively
low. It only causes two leaf ports to break. I'll see what I can do to
help out to get those fixed.

PR: 211626

Change type of MB_CUR_MAX and MB_CUR_MAX_L() to size_t.

POSIX requires that MB_CUR_MAX expands to an expression of type size_t.
It currently expands to an int. As these are already macros, don't
change the underlying type of these functions. There is no ned to touch
those.

Differential Revision: https://reviews.freebsd.org/D6645

Fix typing of srandom() and initstate().

POSIX requires that these functions have an unsigned int for their first
argument; not an unsigned long.

My reasoning is that we can safely change these functions without
breaking the ABI. As far as I know, our supported architectures either
use registers for passing function arguments that are at least as big as
long (e.g., amd64), or int and long are of the same size (e.g., i386).

Reviewed by: ache
Differential Revision: https://reviews.freebsd.org/D6644

Remove incorrect attributes from posix_memalign(3) declaration.

Both __alloc_align and __alloc_size can't be used when the function
returns a pointer to memory. This fixes breakage when building with
clang 3.4:

In file included from /usr/src/svn/usr.sbin/bhyve/atkbdc.c:40:
/usr/include/stdlib.h:176:6: error: '__alloc_size__' attribute only
applies to functions that return a pointer [-Werror,-Wignored-attributes]

Pointed out by: ngie, cem
Approved by: re (gjb)

For C++, expose long long types and functions (lldiv_t, llabs, lldiv,
etc) in stdlib.h. These will be needed for newer versions of libc++,
which uses them for defining overloaded versions of abs() and div().

MFC after: 1 week

Vendor import of libc++ trunk r256633:
https://llvm.org/svn/llvm-project/libcxx/trunk@256633

Make use of GCC alloc_align attribute

This lets the compiler know about the alignment of pointers returned
by aligned_alloc(3), posix_memalign(3). and contigmalloc(9)

Currently this is only supported in recent gcc but we are ready to
use it if clang implements it.

Relnotes: yes

No need for result_use_check attribute in reallocf(3).

Move reallocarray definition to the _BSD_VISIBLE block
Add the required __alloc_size attributes

Requested by: pfg

Import reallocarray(3) from OpenBSD

Add a manpage for it, assign the copyright to the OpenBSD project on it since it
is mostly copy/paste from OpenBSD manpage.
style(9) fixes

Differential Revision: https://reviews.freebsd.org/D2420
Reviewed by: kib

Make use of gcc attributes in some standard include headers.

The `nonnull' attribute specifies that some function parameters should be
non-null pointers. This is very useful as it helps the compiler generate
warnings on suspicious code and can also enable some small optimizations.

Also start using 'alloc_size' attribute in the allocator functions.

This is an initial step to better integrate our libc with the compiler:
these attributes are fully supported by clang and they are also useful
for the static analyzer.

Note that due to some bogus internal procedure in the way gcc ports
are built they may require updating if they were built before r280801.

Relnotes: yes
Hinted by: Android's bionic libc
Differential Revision: https://reviews.freebsd.org/D2107

Clean sparse spaces.

Add bsearch_b to the libc map and the stdlib header.

bsearch_b is the Apple blocks enabled version of bsearch(3).
This was added to libc in Revision 264042 but the commit
missed the declaration required to make use of it.

While here move some other block-related functions to the
BSD_VISIBLE block as these are non-standard.

Phabric: D638
Reviewed by: theraven, wollman

Add support for some block functions that come from OS X. These are
intended to build with any C compiler.

Reviewed by: pfg
MFC after: 3 weeks

Rename __wchar_t so it no longer conflicts with __wchar_t from clang 3.4
-fms-extensions.

MFC after: 2 weeks

Add mkostemp() and mkostemps().

These are like mkstemp() and mkstemps() but allow passing open(2) flags like
O_CLOEXEC.

stdlib.h: Add correct POSIX version for POSIX extensions to C.

1) POSIX requires rand(3) return values to be in the [0, RAND_MAX] range,
but ACM formula we use have internal state (and return value) in the
[1, 0x7ffffffe] range, so our RAND_MAX (0x7fffffff) is never reached
because it is off by one, zero is not reached too.

Correct both RAND_MAX and rand(3) return value, shifting last one
to the 0 by 1 subtracted, resulting POSIXed [0, 0x7ffffffd(=new RAND_MAX)]
range.

2) Add a checks for not overflowing on too big seeds. It may happens on
the machines, where sizeof(unsigned int) > 32 bits.

Reviewed by: bde [1]
MFC after: 2 weeks

Import jemalloc 9ef7f5dc34ff02f50d401e41c8d9a4a928e7c2aa (dev branch,
prior to 3.0.0 release) as contrib/jemalloc, and integrate it into libc.
The code being imported by this commit diverged from
lib/libc/stdlib/malloc.c in March 2010, which means that a portion of
the jemalloc 1.0.0 ChangeLog entries are relevant, as are the entries
for all subsequent releases.

Correctly expose xlocale functions if people include the headers in the wrong
order (as some ports apparently do).

Approved by: dim (mentor)

Expose some C11 stuff that is also C++11 stuff in C++11 mode.

Approved by: dim (mentor)

Add aligned_alloc(3).

The C11 folks reinvented the wheel by introducing an aligned version of
malloc(3) called aligned_alloc(3), instead of posix_memalign(3). Instead
of returning the allocation by reference, it returns the address, just
like malloc(3).

Reviewed by: jasone@

Fix spelling of C11 and sort functions by name.

Improve C11 bits in <stdlib.h>:

- Add missing semicolon to quick_exit(),
- Remove `func' parameter name from at_quick_exit(),
- Fix indentation.
- Compare against 2011 value.

Replace __const by const in all non-contributed source code.

As C1X is close to being released, there is no need to wrap around a
feature that is already part of C90. Most of these files already use
`const' in different placed as well.

As per das@'s suggestion, s/__noreturn/_Noreturn/, since the latter is an
identifier reserved for the implementation in C99 and earlier so there is
no sensible reason for introducing yet another reserved identifier when we
could just use the one C1x uses.

Approved by: brooks (mentor)

Implement quick_exit() / at_quick_exit() from C++11 / C1x. Also add a
__noreturn macro and modify the other exiting functions to use it.

The __noreturn macro, unlike __dead2, must be used BEFORE the function.
This is in line with the C and C++ specifications that place _Noreturn (c1x)
and [[noreturn]] (C++11) in front of the functions. As with __dead2, this
macro falls back to using the GCC attribute.

Unfortunately, clang currently sets the same value for the C version macro
in C99 and C1x modes, so these functions are hidden by default. At some
point before 10.0, I need to go through the headers and clean up the C1x /
C++11 visibility.

Reviewed by: brooks (mentor)

Implement xlocale APIs from Darwin, mainly for use by libc++. This adds a
load of _l suffixed versions of various standard library functions that use
the global locale, making them take an explicit locale parameter. Also
adds support for per-thread locales. This work was funded by the FreeBSD
Foundation.

Please test any code you have that uses the C standard locale functions!

Reviewed by: das (gdtoa changes)
Approved by: dim (mentor)

A new jail(8) with a configuration file, to replace the work currently done
by /etc/rc.d/jail.

MFC r206893:
Slightly modernize realpath(3).

SUSv4 requires that implementation returns EINVAL if supplied path is NULL,
and ENOENT if path is empty string [1].
Bring prototype in conformance with SUSv4, adding restrict keywords.
Allow the resolved path buffer pointer be NULL, in which case realpath(3)
allocates storage with malloc().

MFC r206898:
Free() is not allowed to modify errno, remove safety brackets around it.
Add small optimization, do not copy a string to the buffer that is
to be freed immediately after.

MFC r206997:
Move realpath(3) prototype to a POSIX section.

MFC r206998:
Add standards section, improve wording, taking into account the handling
of NULL and changed type in declaration.

Move realpath(3) prototype to a POSIX section.

Noted by: bde
MFC after: 2 weeks

Slightly modernize realpath(3).

SUSv4 requires that implementation returns EINVAL if supplied path is NULL,
and ENOENT if path is empty string [1].
Bring prototype in conformance with SUSv4, adding restrict keywords.
Allow the resolved path buffer pointer be NULL, in which case realpath(3)
allocates storage with malloc().

PR: kern/121897 [1]
MFC after: 2 weeks

Create the altix project branch. The altix project will add support
for the SGI Altix 350 to FreeBSD/ia64. The hardware used for porting
is a two-module system, consisting of a base compute module and a
CPU expansion module. SGI's NUMAFlex architecture can be an excellent
platform to test CPU affinity and NUMA-aware features in FreeBSD.

Remove the Berkeley clause 3's.
Add a few $FreeBSD$

Namespace: abort2() is a BSD extension.

r189349 removed mktemp() from the XSI namespace when
__XOPEN_SOURCE >= 700, since mktemp() was withdrawn
from the standard. However, __XSI_VISIBLE is set to
700 in the default BSD envrionment, where mktemp()
should still exist; hence, check for this.

- Add getsubopt and mkdtemp to the POSIX.1-2008 namespace.
- Add mkstemp to the POSIX.1-2008 and BSD namespaces.
- Remove mktemp from the XSI namespace.

Add two new routines: fdevname() and fdevname_r().

A more elegant way of obtaining a name of a character device by its file
descriptor on FreeBSD, is to use the FIODGNAME ioctl. Because a valid
file descriptor implies a file descriptor is visible in /dev, it will
always resolve a valid device name.

I'm adding a more friendly wrapper for this ioctl, called fdevname(). It
is a lot easier to use than devname() and also has better error
handling. When a device name cannot be resolved, it will just return
NULL instead of a generated device name that makes no sense.

Discussed with: kib

Add a function attribute called `__malloc_like', which informs gcc
that the annotated function returns a pointer that doesn't alias any
extant pointer. This results in a 50%+ speedup in microbenchmarks such
as the following:

char *cp = malloc(1), *buf = malloc(BUF);
for (i = 0; i < BUF; i++) buf[i] = *cp;

In real programs, your mileage will vary. Note that gcc already
performs this optimization automatically for any function called
`malloc', `calloc', `strdup', or `strndup' unless -fno-builtins is
used.

- Import the HEAD csup code which is the basis for the cvsmode work.

Add arc4random_uniform()

Obtained from: OpenBSD

Add arc4random_buf.
Style: remove arg names from arc4random_addrandom.

Significantly reduce the memory leak as noted in BUGS section for
setenv(3) by tracking the size of the memory allocated instead of using
strlen() on the current value.

Convert all calls to POSIX from historic BSD API:
- unsetenv returns an int.
- putenv takes a char * instead of const char *.
- putenv no longer makes a copy of the input string.
- errno is set appropriately for POSIX. Exceptions involve bad environ
variable and internal initialization code. These both set errno to
EFAULT.

Several patches to base utilities to handle the POSIX changes from
Andrey Chernov's previous commit. A few I re-wrote to use setenv()
instead of putenv().

New regression module for tools/regression/environ to test these
functions. It also can be used to test the performance.

Bump __FreeBSD_version to 700050 due to API change.

PR: kern/99826
Approved by: wes
Approved by: re (kensmith)

Back out all POSIXified *env() changes.

Not because I admit they are technically wrong and not because of bug
reports (I receive nothing). But because I surprisingly meets so
strong opposition and resistance so lost any desire to continue that.

Anyone who interested in POSIX can dig out what changes and how
through cvs diffs.

Fix unsetenv and putenv prototypes to conform Open Group specs Issue 6
(also IEEE Std 1003.1-2001)

Import of OpenBSD's strtonum(3) which is a nicer version of strtoll(3)
providing proper error checking and other improvements.

Obtained from: OpenBSD
Requested by: flz (to port Open[BGP|OSPF]D)
MFC after: 3 days

Expose the posix_memalign() prototype, now that the function is implemented
by libc.

Add a64l(), l64a(), and l64a_r() XSI extentions. These functions convert
between a 32-bit integer and a radix-64 ASCII string. The l64a_r() function
is a NetBSD addition.

PR: 51209 (based on submission, but very different)
Reviewed by: bde, ru

Add abort2() prototype

Fix the prototypes for devname() and devname_r(), the first two argument
types are supposed to be dev_t and mode_t (prefixed with __ due to
namespace reasons).

Implement rpmatch(), a semi-standard interface (as found on AIX, Tru64,
GNU) for determining whether a string is an affirmative or negative
response to a question according to the current locale. This is done
by matching the response against nl_langinfo(3) items YESEXPR and NOEXPR.

POSIX clearly states that getsubopt() should be declared in <stdlib.h>,
not in <unistd.h>

Change the definition of NULL on ia64 (for LP64 compilations) from
an int constant to a long constant. This change improves consistency
in the following two ways:
1. The first 8 arguments are always passed in registers on ia64, which
by virtue of the generated code implicitly widens ints to longs and
allows the use of an 32-bit integral type for 64-bit arguments.
Subsequent arguments are passed onto the memory stack, which does
not exhibit the same behaviour and consequently do not allow this.
In practice this means that variadic functions taking pointers
and given NULL (without cast) work as long as the NULL is passed
in one of the first 8 arguments. A SIGSEGV is more likely the
result if such would be done for stack-based arguments. This is
due to the fact that the upper 4 bytes remain undefined.
2. All 64-bit platforms that FreeBSD supports, with the obvious
exception of ia64, allow 32-bit integral types (specifically NULL)
when 64-bit pointers are expected in variadic functions by way of
how the compiler generates code. As such, code that works correctly
(whether rightfully so or not) on any platform other than ia64, may
fail on ia64.

To more easily allow tweaking of the definition of NULL, this commit
removes the 12 definitions in the various headers and puts it in a
new header that can be included whenever NULL is to be made visible.

This commit fixes GNOME, emacs, xemacs and a whole bunch of ports
that I don't particularly care about at this time...

Push the alloca #error warning farther down to play nicer with some out of
tree local translator.

Requested by: jmallett

Fix a mismerge.

Don't blindly provide alloca() for all compilers -- it is too implementation
dependent. Instead provide one for GCC & Intel's GCC copy and one for lint.
Anyone using any other translator tool needs to look closely at how that tool
can handle alloca.

Remove argument names from a function declaration.

Reviewed by: phk

Add devname_r(3) which takes a buffer as argument.

Use __builtin_alloca() on compilers that have it. Keep the prototype for
the benefit of lint and non-{GNU,Intel} compilers.

Replace our ancient dtoa/strtod implementation with the gdtoa
package, a more recent, generalized set of routines. Among the
changes:
- Declare strtof() and strtold() in stdlib.h.
- Add glue to libc to support these routines for all kinds
of ``long double''.
- Update printf() to reflect the fact that dtoa works slightly
differently now.

As soon as I see that nothing has blown up, I will kill
src/lib/libc/stdlib/strtod.c. Soon printf() will be able
to use the new routines to output long doubles without loss
of precision, but numerous bugs in the existing code must
be addressed first.

Reviewed by: bde (briefly), mike (mentor), obrien

Implement POSIX grantpt(3) functionality, and add a pt_chown utility (akin
to Solaris, it is in /usr/libexec) to perform the handing over of tty nodes
to the user being granted the pty.

Submitted by: Ryan Younce <ryany@pobox.com>
Reviewed by: security-officer@, standards@, mike@

Back out the s/int */size_t */ commit.
It makes a difference on 64-bit arches, and no one really wants a 2^64
block size [yet].

Make the first argument of getbsize a size_t* instead of an int*, as this is what the quantity actually is. Fix an easy const while I'm here.

Whitespace cleanup (half for fixing missing whitespace before `__restrict'
again).

Removed the second pair of banal comments about `quot' and `rem'.

Use new visibility macros. Reorder some disordered declarations. Add
new 1003.1-2001 declarations, commented out in cases where we do not
implement the function. Note that strtoq() and strtouq() are slated
for deletion in 6.0. (2 of 5)

Without fixing the namespace issues, add prototypes for the new _Exit()
and qsort_r() functions. Fix one other missorted declaration.

Style: One space between "restrict" qualifier and "*".

Add restrict qualifiers to the arguments of mbstowcs, mbtowc() and
wcstombs().

o Merge <machine/ansi.h> and <machine/types.h> into a new header
called <machine/_types.h>.
o <machine/ansi.h> will continue to live so it can define MD clock
macros, which are only MD because of gratuitous differences between
architectures.
o Change all headers to make use of this. This mainly involves
changing:
#ifdef _BSD_FOO_T_
typedef _BSD_FOO_T_ foo_t;
#undef _BSD_FOO_T_
#endif
to:
#ifndef _FOO_T_DECLARED
typedef __foo_t foo_t;
#define _FOO_T_DECLARED
#endif

Concept by: bde
Reviewed by: jake, obrien

- Add the 'restrict' qualifier to the function prototypes and
definitions of the functions that convert strings to numbers
and are defined by IEEE Std 1003-1.2001.
- Use ANSI-C function definitions for all of the functions
mentioned above plus strtouq and strtoq.
- Update the prototypes in the manual pages.

Don't define wchar_t if we are a C++ compiler.

PR: 31864, 40084

Convince lint via the standard lint-comment /* LONGLONG */ to not
whine about our (valid) "long long" usage.

Const poison.

Partially submitted by: wollman

Constify _malloc_options.

Breath deep and take __P out of the system include files.

# This appears to not break X11, but I'm having problems compiling the
# glide part of the server with or without this patch, so I can't tell
# for sure.

const poison just like NetBSD.

Move user_from_uid to pwd.h
Move group_from_gid to grp.h
Remove from stdlib.h
Make the prototypes match the code
Fix rm and mv to include new files.

NetBSD has these defined in those files, and others too that I've not
done.

Approved by: terminal room kabal
Reviewed by: jhb, phk

Revert 1.29. It breaks the build. Will figure out a better way to do
this that doesn't break things.

Make the user_from_uid and group_from_gid prototypes match the actual
function definitions.

Fix support for K&R C.

MFC after: 3 days

Oops, actually fix the namespace pollution for atoll() as the previous
commit claimed to do.

Fixed namespace pollution and/or breakage of K&R and C90 support related to
the following functions in the following commits:
- atoll() in revs 1.23-1.25
- llabs() and lldiv() in revs 1.22
- strtoq() and strtouq() in revs 1.18
C99 functions must not be declared in C90/POSIX.1-1990 sections, and
"long long" must not be exposed to compilers that don't support it.

Fixed style bugs (mainly misindentation and disorder) related the
following functions in the following commits:
- atoll() in revs 1.23-1.25
- getprogname() in rev.1.21
- sranddev() in revs 1.19-1.20
- strtoq() and strtouq() in rev.1.13
- user_from_uid() in rev.1.1
Breakage of K&R and C90 support used to be avoided by conditializing the
"long long"s for strtoq() and strtouq() on __STRICT_ANSI__, but the
conditionals should have gone away in rev.1.13 when the "long long"s went
away (the problem was moved to the places that declare quad_t and u_quad_t).

Whitespace formatting

Fix just added atoll prototype

Add atoll(3) to conform POSIX and C99

o Implement imaxabs(), imaxdiv(), llabs(), lldiv().
o Update abs(3), div(3), labs(3), ldiv(3) to reflect standards
conformance and add additional references.

Reviewed by: bde, wollman

Introduce getprogname(3) and setprogname(3) library calls. These get
and set __progname, respectively.

Discussed on: -arch (Feb 2001), -audit
Reviewed by: -audit
Approved by: kris
Obtained from: (mostly) NetBSD

Move sranddev() to !ANSI_SOURCE !POSIX_SOURCE section

Pointed out by: bde

Add sranddev() prototype

Impliment the ISO-C99 strto[u]ll()
and rewrite strto[u]q() in terms of it.

Make it possible to override the function which writes messages to
stderr in case of warnings and errors.

Rename malloc_options to have a leading underscore, I belive I have been
told that is more correct namespace wise.

Fixed missing declaration of rand_r(3).

Little reorganization:
- created internal names for fixed-size integral types, like __int32_t. They
will be used to make several headers self-sufficient.
- <stdlib.h> don't include <machine/types.h> anymore.
- created <sys/inttypes.h>, which can be used as <inttypes.h>.
- declaration of uoff_t and ufs_daddr_t moved to <sys/types.h>.

Reviewed by: bde

Add reallocf to the library. This function is simliar to realloc, but
when it returns NULL to indicate failure, it will also free the memory
that was passed to it, if that was non-null.

This does not change the semantics of realloc.

A second commit will be done to commit the conversion of those places in
the code that can safely use this to avoid memory leaks when confronted
with low memory situations.

Beaten-to-death-but-finally-approved-in: -current

Change the return types for strtoq and strtouq to int64_t and u_int64_t
instead of long long and unsigned long long. Really they should be
quad_t and u_quad_t, but that would require sys/types.h and this
header only includes machine/types.h. The difference here is that
int64_t and u_int64_t on alpha are long and unsigned long, not
long long etc. This is required to pass gcc's type checking where
long != long long even though they are the same size of alpha.

Moved include of <sys/cdefs.h> earlier for the same reasons as moving
it in <sys/types.h>.

PR: 5785

Move machine/types.h to non-standard section
Change order of arc4* functions
Pointed-by: bde

Add arc4random family declaration

Instead of copying fallback code over and over in each program,
implement (better) falback code inside srandomdev() itself.
Change return type from int to void (binary compatibility surprisely
achieved). Userland code will be changed soon.

Add srandomdev() prototype

Merge Lite2 changes -
move getopt etc declarations from stdlib.h to unistd.h

Import CSRG 4.4BSD-Lite2 includes onto vendor branch

Don't use __dead or __pure in user code. They were obfuscations
for gcc >= 2.5 and no-ops for gcc >= 2.6. Converted to use __dead2
or __pure2 where it wasn't already done, except in math.h where use
of __pure was mostly wrong.

Fixed longstanding namespace convolution involving rune_t vs wchar_t.
If _ANSI_SOURCE or _POSIX_SOURCE is defined, then <ctype.h> had to
be included before <stddef.h> or <stdlib.h> to get rune_t declared.
Now rune_t is declared perfectly bogusly in all cases when <ctype.h>
is included.

This change breaks similar (but more convoluted) convolutions in the
stddef.h in gcc distributions. Ports of gcc should avoid using the
gcc headers.

Don't declare rune_t, putenv() or setenv() if _POSIX_SOURCE is declared.
Previously they were only guarded by `#ifndef _ANSI_SOURCE'. They are
neither ANSI nor POSIX nor std and should never have been declared here.

Declare functions like abs() as having attribute `__pure2'. Declaring them
as having type `__pure' has been a no-op for some time.

Delete obsolete comment about stub locale functions.

Use consistent formatting for the rand48 functions. These and about 30
other functions should never have been declared here either.

Reviewed by: Bruce Evans
Add prototypes for the *rand48 family here in the moment to get them
running again.

Declare functions that don't return as having attribute __dead2.

BSD 4.4 Lite Include Sources