valgrind-developers — Discussion list for developers of valgrind

[Valgrind-developers] [valgrind] s390x: Reflect arch15 (z17) support in NEWS

[Andreas A. <ar...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=5177bfdd7ac14b7134afba70c4b7fd2f10a0158a

commit 5177bfdd7ac14b7134afba70c4b7fd2f10a0158a
Author: Andreas Arnez <ar...@li...>
Date:   Fri Mar 6 12:25:48 2026 +0100

    s390x: Reflect arch15 (z17) support in NEWS
    
    Document the new z/Architecture (edition 15) support in the NEWS file.

Diff:
---
 NEWS | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 5e68da56a0..08db26971c 100644
--- a/NEWS
+++ b/NEWS
@@ -28,7 +28,11 @@ for nanoMIPS/Linux. macOS is supported up to version 12 Monterey (amd64 only).
 
 * ================== PLATFORM CHANGES =================
 
-s390x: Machine models older than z196 are no longer supported.
+* s390x: Machine models older than z196 are no longer supported.
+
+* s390x: Support new z/Architecture features from the 15th edition.  In
+  particular this enables running binaries compiled with `-march=arch15'
+  or `-march=z17' and exploiting the new MSA extensions 10-13.
 
 Support for the following macOS versions has been added
 10.13 High Sierra (bug fixes)
@@ -59,6 +63,9 @@ are not entered into bugzilla tend to get forgotten about or ignored.
         clang 7.0
 413369  unhandled amd64-darwin syscall: unix:151 (getpgid)
 487055  memcheck/tests/x86-linux/scalar fails running in Docker
+503238  s390x: Support miscellaneous-instruction-extensions facility 4
+503239  s390x: Support vector-enhancements facility 3
+503240  s390x: Support MSA extensions 10, 11, and 12
 509562  s390x: Define minimum required machine model
 510416  Missing syswraps for file_getattr and file_setattr
 510563  Add missing syswraps for lsm_get_self_attr and lsm_set_self_attr

[Valgrind-developers] [valgrind] Bug 516289 - illumos lsframe2 regtest fails

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=6b58a3426a259a74366573afb83bf41fe5901659

commit 6b58a3426a259a74366573afb83bf41fe5901659
Author: Paul Floyd <pj...@wa...>
Date:   Thu Mar 5 15:05:29 2026 +0100

    Bug 516289 - illumos lsframe2 regtest fails

Diff:
---
 NEWS                                  | 1 +
 coregrind/m_syswrap/syswrap-solaris.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/NEWS b/NEWS
index 25aa565101..5e68da56a0 100644
--- a/NEWS
+++ b/NEWS
@@ -96,6 +96,7 @@ are not entered into bugzilla tend to get forgotten about or ignored.
 515810  Update the LTP version in valgrind testsuite to 20260130
 515992  Add FreeBSD /proc virtualisation for cmdline and file
 516090  Regression : Linux FreeBSD and Darwin: refactor *at syscall dirfd checks
+516289  illumos lsframe2 regtest fails
 516748  Incorrect use of SET_STATUS_Failure for syscall wrappers that return
         error codes rather than -1 on error
 
diff --git a/coregrind/m_syswrap/syswrap-solaris.c b/coregrind/m_syswrap/syswrap-solaris.c
index a77adf91fd..b122d9627e 100644
--- a/coregrind/m_syswrap/syswrap-solaris.c
+++ b/coregrind/m_syswrap/syswrap-solaris.c
@@ -5010,7 +5010,7 @@ PRE(sys_getsetcontext)
 
          /* The thread is setting the ustack pointer.  It is a good time to get
             information about its stack. */
-         if (tst->os_state.ustack->ss_flags == 0) {
+         if (tst->os_state.ustack->ss_flags == 0 && tid != 1) {
             /* If the sanity check of ss_flags passed set the stack. */
             set_stack(tid, tst->os_state.ustack);

[Valgrind-developers] [valgrind] Solaris setup_client_stack stack extent

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=f661c8209da0a0b911c01e6731c37aef8332444a

commit f661c8209da0a0b911c01e6731c37aef8332444a
Author: Paul Floyd <pj...@wa...>
Date:   Thu Mar 5 08:51:10 2026 +0100

    Solaris setup_client_stack stack extent
    
    This wasn't using the offsets for inner and VG_(clstk_end) didn't
    account for anon_size. This does not affect Bug 516289, sadly.

Diff:
---
 coregrind/m_initimg/initimg-solaris.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/coregrind/m_initimg/initimg-solaris.c b/coregrind/m_initimg/initimg-solaris.c
index 7c9cf0efc6..1c6cd323e9 100644
--- a/coregrind/m_initimg/initimg-solaris.c
+++ b/coregrind/m_initimg/initimg-solaris.c
@@ -499,11 +499,6 @@ static Addr setup_client_stack(Addr init_sp,
    /* Calculate the max stack size. */
    clstack_max_size = VG_PGROUNDUP(clstack_max_size);
 
-   /* Record stack extent -- needed for stack-change code. */
-   VG_(clstk_start_base) = clstack_start;
-   VG_(clstk_end) = clstack_end;
-   VG_(clstk_max_size) = clstack_max_size;
-
    if (0)
       VG_(printf)("stringsize=%lu, auxsize=%lu, stacksize=%lu, maxsize=%#lx\n"
                   "clstack_start %#lx\n"
@@ -576,6 +571,14 @@ static Addr setup_client_stack(Addr init_sp,
          VG_(exit)(1);
          /*NOTREACHED*/
       }
+
+      /* Record stack extent -- needed for stack-change code. */
+      VG_(clstk_start_base) = anon_start -inner_HACK;
+      VG_(clstk_end)  = VG_(clstk_start_base) + anon_size +inner_HACK -1;
+      // Only Solaris sets this despite a comment in syswrap-generic.c
+      // that all platforms should set it.
+      VG_(clstk_max_size) = clstack_max_size;
+
    }
 
    /* ==================== create client stack ==================== */

[Valgrind-developers] [valgrind] Bug 503240 - s390x: Support MSA 10, 11, 12, and 13

[Andreas A. <ar...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=c1cd87ff5b81a9ede538ca1c8bf4be8fb090a6cc

commit c1cd87ff5b81a9ede538ca1c8bf4be8fb090a6cc
Author: Andreas Arnez <ar...@li...>
Date:   Thu Mar 5 13:25:07 2026 +0100

    Bug 503240 - s390x: Support MSA 10, 11, 12, and 13
    
    Add support for the message-security-assist extensions 10-13.  These
    extensions don't add any new instructions, but add new capabilities to
    existing instructions.

Diff:
---
 VEX/priv/guest_s390_toIR.c              |  18 ++-
 VEX/priv/host_s390_defs.h               |   2 +
 VEX/priv/main_main.c                    |   1 +
 VEX/pub/libvex.h                        |   4 +-
 coregrind/m_extension/extension-s390x.c | 262 +++++++++++++++++++++++---------
 coregrind/m_machine.c                   |   3 +-
 6 files changed, 209 insertions(+), 81 deletions(-)

diff --git a/VEX/priv/guest_s390_toIR.c b/VEX/priv/guest_s390_toIR.c
index 4bd3468a1b..9c68d5b2d0 100644
--- a/VEX/priv/guest_s390_toIR.c
+++ b/VEX/priv/guest_s390_toIR.c
@@ -17688,19 +17688,25 @@ s390_irgen_KMC(UChar r1, UChar r2)
 }
 
 static void
-s390_irgen_KIMD(UChar r1, UChar r2)
+s390_irgen_KIMD(UChar r1, UChar r2, UChar m3)
 {
    /* r1 is reserved */
    s390_insn_assert(r2 != 0 && r2 % 2 == 0);
-   extension(S390_EXT_KIMD, r1 | (r2 << 4));
+   if (!s390_host_has_msa12) {
+      m3 = 0;
+   }
+   extension(S390_EXT_KIMD, r1 | (r2 << 4) | (m3 << 8));
 }
 
 static void
-s390_irgen_KLMD(UChar r1, UChar r2)
+s390_irgen_KLMD(UChar r1, UChar r2, UChar m3)
 {
    /* r1 is only used by some functions */
    s390_insn_assert(r2 != 0 && r2 % 2 == 0);
-   extension(S390_EXT_KLMD, r1 | (r2 << 4));
+   if (!s390_host_has_msa12) {
+      m3 = 0;
+   }
+   extension(S390_EXT_KLMD, r1 | (r2 << 4) | (m3 << 8));
 }
 
 static void
@@ -19007,9 +19013,9 @@ s390_decode_4byte_and_irgen(const UChar *bytes)
                 goto ok;
    case 0xb93c: s390_irgen_PRNO(RRE_r1(ovl), RRE_r2(ovl));
                 goto ok;
-   case 0xb93e: s390_irgen_KIMD(RRE_r1(ovl), RRE_r2(ovl));
+   case 0xb93e: s390_irgen_KIMD(RRFc_r1(ovl), RRFc_r2(ovl), RRFc_m3(ovl));
                 goto ok;
-   case 0xb93f: s390_irgen_KLMD(RRE_r1(ovl), RRE_r2(ovl));
+   case 0xb93f: s390_irgen_KLMD(RRFc_r1(ovl), RRFc_r2(ovl), RRFc_m3(ovl));
                 goto ok;
    case 0xb941: s390_irgen_CFDTR(RRFe_m3(ovl), RRFe_m4(ovl), RRFe_r1(ovl),
                                  RRFe_r2(ovl));
diff --git a/VEX/priv/host_s390_defs.h b/VEX/priv/host_s390_defs.h
index 5dc263881a..873e921290 100644
--- a/VEX/priv/host_s390_defs.h
+++ b/VEX/priv/host_s390_defs.h
@@ -954,6 +954,8 @@ extern UInt s390_host_hwcaps;
                       (s390_host_hwcaps & (VEX_HWCAPS_S390X_MI3))
 #define s390_host_has_vxe3 \
                       (s390_host_hwcaps & (VEX_HWCAPS_S390X_VXE3))
+#define s390_host_has_msa12 \
+                      (s390_host_hwcaps & (VEX_HWCAPS_S390X_MSA12))
 #endif /* ndef __VEX_HOST_S390_DEFS_H */
 
 /*---------------------------------------------------------------*/
diff --git a/VEX/priv/main_main.c b/VEX/priv/main_main.c
index 8620b83368..e2f20fc31c 100644
--- a/VEX/priv/main_main.c
+++ b/VEX/priv/main_main.c
@@ -1916,6 +1916,7 @@ static const HChar* show_hwcaps_s390x ( UInt hwcaps )
       { VEX_HWCAPS_S390X_MSA8,  "msa8" },
       { VEX_HWCAPS_S390X_MSA9,  "msa9" },
       { VEX_HWCAPS_S390X_VXE3,  "vxe3" },
+      { VEX_HWCAPS_S390X_MSA12, "msa12" },
    };
    /* Allocate a large enough buffer */
    static HChar buf[sizeof prefix + 
diff --git a/VEX/pub/libvex.h b/VEX/pub/libvex.h
index 0dd4c30f3f..f22a264f81 100644
--- a/VEX/pub/libvex.h
+++ b/VEX/pub/libvex.h
@@ -175,6 +175,7 @@ typedef
 #define VEX_HWCAPS_S390X_MSA9  (1 << 16) /* Message-security-assist extension 9 */
 #define VEX_HWCAPS_S390X_MI3   (1 << 17) /* Miscellaneous-instruction-extensions facility 3 */
 #define VEX_HWCAPS_S390X_VXE3  (1 << 18) /* Vector-enhancements facility 3 */
+#define VEX_HWCAPS_S390X_MSA12 (1 << 19) /* Msg.-security-assist extension 12 */
 
 /* Special value representing all available s390x hwcaps */
 #define VEX_HWCAPS_S390X_ALL   (VEX_HWCAPS_S390X_VX    | \
@@ -189,7 +190,8 @@ typedef
                                 VEX_HWCAPS_S390X_MSA8  | \
                                 VEX_HWCAPS_S390X_MSA9  | \
                                 VEX_HWCAPS_S390X_MI3   | \
-                                VEX_HWCAPS_S390X_VXE3)
+                                VEX_HWCAPS_S390X_VXE3  | \
+                                VEX_HWCAPS_S390X_MSA12)
 
 #define VEX_HWCAPS_S390X(x)  ((x) & ~VEX_S390X_MODEL_MASK)
 #define VEX_S390X_MODEL(x)   ((x) &  VEX_S390X_MODEL_MASK)
diff --git a/coregrind/m_extension/extension-s390x.c b/coregrind/m_extension/extension-s390x.c
index f2542df734..efb9b8ceca 100644
--- a/coregrind/m_extension/extension-s390x.c
+++ b/coregrind/m_extension/extension-s390x.c
@@ -7,7 +7,7 @@
    This file is part of Valgrind, a dynamic binary instrumentation
    framework.
 
-   Copyright (C) IBM Corp. 2024
+   Copyright (C) IBM Corp. 2024-2026
 
    This program is free software; you can redistribute it and/or
    modify it under the terms of the GNU General Public License as
@@ -37,10 +37,14 @@
 
 #undef SYSNO
 
-#define READ_FUNCTION_CODE(tst, extname)                                       \
+/* Divide by 4 and assure zero remainder (else force div. by zero) */
+#define S390_WORD_LEN(len) ((len) / ((len) % 4 ? 0 : 4))
+
+#define READ_FUNCTION_CODE(tst, extname, ty)                                   \
    ({                                                                          \
-      PRE_REG_READ(tst, extname "(func_code)", r0, 7, sizeof(UChar));          \
-      tst->arch.vex.guest_r0 & 0xff;                                           \
+      PRE_REG_READ(tst, extname "(func_code)", r0, 8 - sizeof(ty),             \
+                   sizeof(ty));                                                \
+      (ty) tst->arch.vex.guest_r0;                                             \
    })
 
 #define READ_GPR(tst, name, regno)                                             \
@@ -107,7 +111,7 @@ union reg_pair {
       return cc >> 28;                                                         \
    }
 
-#define S390_DEFINE_DO_RR_INSN(fname, opc)                                     \
+#define S390_DEFINE_DO_RR_INSN(fname, opc, m3)                                 \
    static Int fname(ULong func, ULong parms, ULong* addr1, ULong* len1,        \
                     ULong* addr2, ULong* len2)                                 \
    {                                                                           \
@@ -117,7 +121,7 @@ union reg_pair {
       register void* reg1 asm("1") = (void*)parms;                             \
       UInt           cc;                                                       \
                                                                                \
-      asm volatile(".insn rre, " #opc "0000, %[op1], %[op2]\n"                 \
+      asm volatile(".insn rre, " #opc m3 "000, %[op1], %[op2]\n"               \
                    "ipm %[cc]\n"                                               \
                    : [cc] "=d"(cc), [op1] "+a"(op1.pair), [op2] "+a"(op2.pair) \
                    : "d"(reg0), "d"(reg1)                                      \
@@ -129,7 +133,7 @@ union reg_pair {
       return cc >> 28;                                                         \
    }
 
-#define S390_DEFINE_DO_0R_INSN(fname, opc)                                     \
+#define S390_DEFINE_DO_0R_INSN(fname, opc, m3)                                 \
    static Int fname(ULong func, ULong parms, ULong* addr2, ULong* len2)        \
    {                                                                           \
       union reg_pair op2           = {{*addr2, *len2}};                        \
@@ -137,7 +141,7 @@ union reg_pair {
       register void* reg1 asm("1") = (void*)parms;                             \
       UInt           cc;                                                       \
                                                                                \
-      asm volatile(".insn rre, " #opc "0000, 0, %[op2]\n"                      \
+      asm volatile(".insn rre, " #opc m3 "000, 0, %[op2]\n"                    \
                    "ipm %[cc]\n"                                               \
                    : [cc] "=d"(cc), [op2] "+a"(op2.pair)                       \
                    : "d"(reg0), "d"(reg1)                                      \
@@ -187,21 +191,22 @@ static void s390_filter_functions(ULong*       fc,
 /*--- PRNO (perform random number operation)                  ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_RR_INSN(do_PRNO_insn, 0xb93c)
+S390_DEFINE_DO_RR_INSN(do_PRNO_insn, 0xb93c, "0")
 
 /* PRNO functions that we support if the hardware does. */
 static const ULong PRNO_functions[] = {
    (S390_SETBIT(0)       // Query
     | S390_SETBIT(3)),   // SHA-512-DRNG
    (S390_SETBIT(112)     // TRNG-Query-Raw-to-Conditioned-Ratio
-    | S390_SETBIT(114)), // TRNG
+    | S390_SETBIT(114)   // TRNG
+    | S390_SETBIT(127)), // PRNO-Query-Authentication-Information
 };
 
 static enum ExtensionError do_extension_PRNO(ThreadState* tst, ULong variant)
 {
    UChar r1    = variant & 0xf;
    UChar r2    = (variant >> 4) & 0xf;
-   UChar func  = READ_FUNCTION_CODE(tst, "PRNO");
+   UChar func  = READ_FUNCTION_CODE(tst, "PRNO", UChar);
    UChar fc    = func & 0x7f;
    UChar mflag = func & 128;
    ULong parms = READ_GPR(tst, "PRNO(r1)", 1);
@@ -263,6 +268,12 @@ static enum ExtensionError do_extension_PRNO(ThreadState* tst, ULong variant)
       POST_MEM_WRITE(tst, orig_addr1, orig_len1 - len1);
       POST_MEM_WRITE(tst, orig_addr2, orig_len2 - len2);
       break;
+   case 127: // Query authentication information
+      parms_len = 256;
+      PRE_MEM_WRITE(tst, "PRNO(parms)", parms, parms_len);
+      cc = do_PRNO_insn(func, parms, &addr1, &len1, &addr2, &len2);
+      POST_MEM_WRITE(tst, parms, parms_len);
+      break;
    default:
       return INSN_ERR("PRNO: unknown function code\n");
    }
@@ -809,7 +820,7 @@ static UWord do_extension_DFLTCC(ThreadState* tst, ULong variant)
    UChar r1    = variant & 0xf;
    UChar r2    = (variant >> 4) & 0xf;
    UChar r3    = (variant >> 8) & 0xf;
-   UChar func  = READ_FUNCTION_CODE(tst, "DFLTCC");
+   UInt  func  = READ_FUNCTION_CODE(tst, "DFLTCC", UInt);
    UChar fc    = func & 0x7f;
    Bool  hbt   = (func & 128) != 0;
    ULong parms = READ_GPR(tst, "DFLTCC(r1)", 1);
@@ -959,7 +970,7 @@ static enum ExtensionError do_extension_STFLE(ThreadState* tst, ULong variant)
        /* 83: unassigned */
        | S390_SETBITS(84, 84)
        /* 85: sequential-instruction, not supported */
-       /* 86: MSA 12, not supported */
+       | S390_SETBITS(86, 86)
        /* 87: PLO-extension, not supported */
        /* 88-127: unassigned */
        ),
@@ -1012,7 +1023,7 @@ static enum ExtensionError do_extension_STFLE(ThreadState* tst, ULong variant)
 /*--- KM (cypher message)                                     ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_RR_INSN(do_KM_insn, 0xb92e)
+S390_DEFINE_DO_RR_INSN(do_KM_insn, 0xb92e, "0")
 
 /* List all the functions supported.  This list provides the parameter block
    sizes and will also be used for filtering the supported functions.  The
@@ -1037,21 +1048,30 @@ S390_DEFINE_DO_RR_INSN(do_KM_insn, 0xb92e)
    S390_DO_FUNC(58, S390_KM_XTS_Encrypted_AES_128, 64)                         \
    S390_DO_FUNC(60, S390_KM_XTS_Encrypted_AES_256, 80)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
-static const UChar S390_KM_parms_len[] = {S390_DO_FUNCTIONS};
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(82, S390_KM_Full_XTS_AES_128, 64)                              \
+   S390_DO_FUNC(84, S390_KM_Full_XTS_AES_256, 96)                              \
+   S390_DO_FUNC(90, S390_KM_Full_XTS_Encrypted_AES_128, 96)                    \
+   S390_DO_FUNC(92, S390_KM_Full_XTS_Encrypted_AES_256, 128)                   \
+   S390_DO_FUNC(127, S390_KM_Query_Authentication_Information, 256)
+
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
+static const UChar S390_KM_parms_len[] = {S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #define S390_DO_FUNC(fc, name, plen) | S390_SETBIT(fc)
-static const ULong S390_KM_supported_fc[] = {0 S390_DO_FUNCTIONS};
+static const ULong S390_KM_supported_fc[] = {0 S390_DO_FUNCTIONS,
+                                             0 S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #undef S390_DO_FUNCTIONS
+#undef S390_DO_FUNCTIONS1
 
 static enum ExtensionError do_extension_KM(ThreadState* tst, ULong variant)
 {
    UChar r1        = variant & 0xf;
    UChar r2        = (variant >> 4) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KM");
+   UInt  func      = READ_FUNCTION_CODE(tst, "KM", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KM(r1)", 1);
    ULong parms_len = 0;
@@ -1060,7 +1080,7 @@ static enum ExtensionError do_extension_KM(ThreadState* tst, ULong variant)
    ULong addr1 = 0, len1 = 0, addr2 = 0, len2 = 0;
 
    if (fc < sizeof(S390_KM_parms_len) / sizeof(S390_KM_parms_len[0]))
-      parms_len = S390_KM_parms_len[fc];
+      parms_len = S390_KM_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KM: unknown function code\n");
 
@@ -1070,6 +1090,10 @@ static enum ExtensionError do_extension_KM(ThreadState* tst, ULong variant)
       s390_filter_functions((ULong*)parms, parms_len, S390_KM_supported_fc,
                             sizeof(S390_KM_supported_fc));
       POST_MEM_WRITE(tst, parms, parms_len);
+   } else if (fc == 127) { // Query authentication information
+      PRE_MEM_WRITE(tst, "KM(parms)", parms, parms_len);
+      cc = do_KM_insn(func, parms, &addr1, &len1, &addr2, &len2);
+      POST_MEM_WRITE(tst, parms, parms_len);
    } else {
       addr1 = orig_addr1 = READ_GPR(tst, "KM(op1_addr)", r1);
       addr2              = READ_GPR(tst, "KM(op2_addr)", r2);
@@ -1091,7 +1115,7 @@ static enum ExtensionError do_extension_KM(ThreadState* tst, ULong variant)
 /*--- KMC (cypher message with chaining)                      ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_RR_INSN(do_KMC_insn, 0xb92f)
+S390_DEFINE_DO_RR_INSN(do_KMC_insn, 0xb92f, "0")
 
 #define S390_DO_FUNCTIONS                                                      \
    S390_DO_FUNC(0, S390_KMC_Query, 16)                                         \
@@ -1108,9 +1132,11 @@ S390_DEFINE_DO_RR_INSN(do_KMC_insn, 0xb92f)
    S390_DO_FUNC(27, S390_KMC_Encrypted_AES_192, 72)                            \
    S390_DO_FUNC(28, S390_KMC_Encrypted_AES_256, 80)
 
-#define S390_DO_FUNCTIONS1 S390_DO_FUNC(67, S390_KMC_PRNG, 32)
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(67, S390_KMC_PRNG, 32)                                         \
+   S390_DO_FUNC(127, S390_KMC_Query_Authentication_Information, 256)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
 static const UChar S390_KMC_parms_len[] = {
    S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
@@ -1127,7 +1153,7 @@ static enum ExtensionError do_extension_KMC(ThreadState* tst, ULong variant)
 {
    UChar r1        = variant & 0xf;
    UChar r2        = (variant >> 4) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KMC");
+   UInt  func      = READ_FUNCTION_CODE(tst, "KMC", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KMC(r1)", 1);
    ULong parms_len = 0;
@@ -1136,7 +1162,7 @@ static enum ExtensionError do_extension_KMC(ThreadState* tst, ULong variant)
    ULong addr1 = 0, len1 = 0, addr2 = 0, len2 = 0;
 
    if (fc < sizeof(S390_KMC_parms_len) / sizeof(S390_KMC_parms_len[0]))
-      parms_len = S390_KMC_parms_len[fc];
+      parms_len = S390_KMC_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KMC: unknown function code\n");
 
@@ -1145,6 +1171,9 @@ static enum ExtensionError do_extension_KMC(ThreadState* tst, ULong variant)
       cc = do_KMC_insn(func, parms, &addr1, &len1, &addr2, &len2);
       s390_filter_functions((ULong*)parms, parms_len, S390_KMC_supported_fc,
                             sizeof(S390_KMC_supported_fc));
+   } else if (fc == 127) { // Query authentication information
+      PRE_MEM_WRITE(tst, "KMC(parms)", parms, parms_len);
+      cc = do_KMC_insn(func, parms, &addr1, &len1, &addr2, &len2);
    } else {
       addr1 = orig_addr1 = READ_GPR(tst, "KMC(op1_addr)", r1);
       addr2              = READ_GPR(tst, "KMC(op2_addr)", r2);
@@ -1167,7 +1196,8 @@ static enum ExtensionError do_extension_KMC(ThreadState* tst, ULong variant)
 /*--- KIMD (compute intermediate message digest)              ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_0R_INSN(do_KIMD_insn, 0xb93e)
+S390_DEFINE_DO_0R_INSN(do_KIMD_insn, 0xb93e, "0")
+S390_DEFINE_DO_0R_INSN(do_KIMD8_insn, 0xb93e, "8")
 
 #define S390_DO_FUNCTIONS                                                      \
    S390_DO_FUNC(0, S390_KIMD_Query, 16)                                        \
@@ -1181,9 +1211,11 @@ S390_DEFINE_DO_0R_INSN(do_KIMD_insn, 0xb93e)
    S390_DO_FUNC(36, S390_KIMD_SHAKE_128, 200)                                  \
    S390_DO_FUNC(37, S390_KIMD_SHAKE_256, 200)
 
-#define S390_DO_FUNCTIONS1 S390_DO_FUNC(65, S390_KIMD_GHASH, 32)
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(65, S390_KIMD_GHASH, 32)                                       \
+   S390_DO_FUNC(127, S390_KIMD_Query_Authentication_Information, 256)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
 static const UChar S390_KIMD_parms_len[] = {
    S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
@@ -1199,7 +1231,8 @@ static const ULong S390_KIMD_supported_fc[] = {0 S390_DO_FUNCTIONS,
 static enum ExtensionError do_extension_KIMD(ThreadState* tst, ULong variant)
 {
    UChar r2        = (variant >> 4) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KIMD");
+   UChar m3        = (variant >> 8) & 0xf;
+   UInt  func      = READ_FUNCTION_CODE(tst, "KIMD", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KIMD(r1)", 1);
    ULong parms_len = 0;
@@ -1207,7 +1240,7 @@ static enum ExtensionError do_extension_KIMD(ThreadState* tst, ULong variant)
    ULong addr2 = 0, len2 = 0;
 
    if (fc < sizeof(S390_KIMD_parms_len) / sizeof(S390_KIMD_parms_len[0]))
-      parms_len = S390_KIMD_parms_len[fc];
+      parms_len = S390_KIMD_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KIMD: unknown function code\n");
 
@@ -1217,13 +1250,23 @@ static enum ExtensionError do_extension_KIMD(ThreadState* tst, ULong variant)
       s390_filter_functions((ULong*)parms, parms_len, S390_KIMD_supported_fc,
                             sizeof(S390_KIMD_supported_fc));
       POST_MEM_WRITE(tst, parms, parms_len);
+   } else if (fc == 127) { // Query authentication information
+      parms_len = 256;
+      PRE_MEM_WRITE(tst, "KIMD(parms)", parms, parms_len);
+      cc = do_KIMD_insn(func, parms, &addr2, &len2);
+      POST_MEM_WRITE(tst, parms, parms_len);
    } else {
       addr2 = READ_GPR(tst, "KIMD(op2_addr)", r2);
       len2  = READ_GPR(tst, "KIMD(op2_len)", r2 + 1);
-      PRE_MEM_READ(tst, "KIMD(parms)", parms, parms_len);
+
+      /* The parm block is an input unless the "no-ICV-parameter" applies */
+      if ((m3 & 8) == 0 || (func & 0x8000) == 0 || fc < 32 || fc > 37) {
+         PRE_MEM_READ(tst, "KIMD(parms)", parms, parms_len);
+      }
       PRE_MEM_WRITE(tst, "KIMD(parms)", parms, parms_len);
       PRE_MEM_READ(tst, "KIMD(op2)", addr2, len2);
-      cc = do_KIMD_insn(func, parms, &addr2, &len2);
+      cc = (m3 & 8) == 0 ? do_KIMD_insn(func, parms, &addr2, &len2)
+                         : do_KIMD8_insn(func, parms, &addr2, &len2);
       WRITE_GPR(tst, r2, addr2);
       WRITE_GPR(tst, r2 + 1, len2);
       POST_MEM_WRITE(tst, parms, parms_len);
@@ -1236,7 +1279,8 @@ static enum ExtensionError do_extension_KIMD(ThreadState* tst, ULong variant)
 /*--- KLMD (compute last message digest)                      ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_RR_INSN(do_KLMD_insn, 0xb93f)
+S390_DEFINE_DO_RR_INSN(do_KLMD_insn, 0xb93f, "0")
+S390_DEFINE_DO_RR_INSN(do_KLMDf_insn, 0xb93f, "8")
 
 #define S390_DO_FUNCTIONS                                                      \
    S390_DO_FUNC(0, S390_KLMD_Query, 16)                                        \
@@ -1250,21 +1294,28 @@ S390_DEFINE_DO_RR_INSN(do_KLMD_insn, 0xb93f)
    S390_DO_FUNC(36, S390_KLMD_SHAKE_128, 200)                                  \
    S390_DO_FUNC(37, S390_KLMD_SHAKE_256, 200)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
-static const UChar S390_KLMD_parms_len[] = {S390_DO_FUNCTIONS};
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(127, S390_KLMD_Query_Authentication_Information, 256)
+
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
+static const UChar S390_KLMD_parms_len[] = {
+   S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #define S390_DO_FUNC(fc, name, plen) | S390_SETBIT(fc)
-static const ULong S390_KLMD_supported_fc[] = {0 S390_DO_FUNCTIONS};
+static const ULong S390_KLMD_supported_fc[] = {0 S390_DO_FUNCTIONS,
+                                               0 S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #undef S390_DO_FUNCTIONS
+#undef S390_DO_FUNCTIONS1
 
 static enum ExtensionError do_extension_KLMD(ThreadState* tst, ULong variant)
 {
    UChar r1         = variant & 0xf;
    UChar r2         = (variant >> 4) & 0xf;
-   ULong func       = READ_GPR(tst, "KLMD(r0)", 0);
+   UChar m3         = (variant >> 8) & 0xf;
+   UInt  func       = READ_FUNCTION_CODE(tst, "KLMD", UInt);
    UChar fc         = func & 0x7f;
    ULong parms      = READ_GPR(tst, "KLMD(r1)", 1);
    ULong parms_len  = 0;
@@ -1273,7 +1324,7 @@ static enum ExtensionError do_extension_KLMD(ThreadState* tst, ULong variant)
    ULong addr1 = 0, len1 = 0, addr2 = 0, len2 = 0;
 
    if (fc < sizeof(S390_KLMD_parms_len) / sizeof(S390_KLMD_parms_len[0]))
-      parms_len = S390_KLMD_parms_len[fc];
+      parms_len = S390_KLMD_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KLMD: unknown function code\n");
    PRE_MEM_WRITE(tst, "KLMD(parms)", parms, parms_len);
@@ -1282,11 +1333,16 @@ static enum ExtensionError do_extension_KLMD(ThreadState* tst, ULong variant)
       cc = do_KLMD_insn(func, parms, &addr1, &len1, &addr2, &len2);
       s390_filter_functions((ULong*)parms, parms_len, S390_KLMD_supported_fc,
                             sizeof(S390_KLMD_supported_fc));
+   } else if (fc == 127) { // Query authentication information
+      cc = do_KLMD_insn(func, parms, &addr1, &len1, &addr2, &len2);
    } else {
       /* The "shake" functions use the first operand */
       Bool have_op1 = fc >= 36 && fc <= 37;
 
-      PRE_MEM_READ(tst, "KLMD(parms)", parms, parms_len);
+      /* The parm block is an input unless the "no-ICV-parameter" applies */
+      if ((m3 & 8) == 0 || (func & 0x8000) == 0 || fc < 32 || fc > 37) {
+         PRE_MEM_READ(tst, "KLMD(parms)", parms, parms_len);
+      }
       if (have_op1) {
          if (r1 == 0 || r1 % 2 != 0)
             return INSN_ERR("KLMD: bad r1 field");
@@ -1297,7 +1353,9 @@ static enum ExtensionError do_extension_KLMD(ThreadState* tst, ULong variant)
       addr2 = READ_GPR(tst, "KLMD(op2_addr)", r2);
       len2  = READ_GPR(tst, "KLMD(op2_len)", r2 + 1);
       PRE_MEM_READ(tst, "KLMD(op2)", addr2, len2);
-      cc = do_KLMD_insn(func, parms, &addr1, &len1, &addr2, &len2);
+      cc = (m3 & 8) == 0
+              ? do_KLMD_insn(func, parms, &addr1, &len1, &addr2, &len2)
+              : do_KLMDf_insn(func, parms, &addr1, &len1, &addr2, &len2);
       if (have_op1) {
          WRITE_GPR(tst, r1, addr1);
          WRITE_GPR(tst, r1 + 1, len1);
@@ -1315,7 +1373,7 @@ static enum ExtensionError do_extension_KLMD(ThreadState* tst, ULong variant)
 /*--- KMAC (compute message authentication code)              ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_0R_INSN(do_KMAC_insn, 0xb91e)
+S390_DEFINE_DO_0R_INSN(do_KMAC_insn, 0xb91e, "0")
 
 #define S390_DO_FUNCTIONS                                                      \
    S390_DO_FUNC(0, S390_KMAC_Query, 16)                                        \
@@ -1332,20 +1390,34 @@ S390_DEFINE_DO_0R_INSN(do_KMAC_insn, 0xb91e)
    S390_DO_FUNC(27, S390_KMAC_Encrypted_AES_192, 72)                           \
    S390_DO_FUNC(28, S390_KMAC_Encrypted_AES_256, 80)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
-static const UChar S390_KMAC_parms_len[] = {S390_DO_FUNCTIONS};
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(112, S390_KMAC_HMAC_SHA_224, 104)                              \
+   S390_DO_FUNC(113, S390_KMAC_HMAC_SHA_256, 104)                              \
+   S390_DO_FUNC(114, S390_KMAC_HMAC_SHA_384, 208)                              \
+   S390_DO_FUNC(115, S390_KMAC_HMAC_SHA_512, 208)                              \
+   S390_DO_FUNC(120, S390_KMAC_HMAC_Encrypted_SHA_224, 136)                    \
+   S390_DO_FUNC(121, S390_KMAC_HMAC_Encrypted_SHA_256, 136)                    \
+   S390_DO_FUNC(122, S390_KMAC_HMAC_Encrypted_SHA_384, 240)                    \
+   S390_DO_FUNC(123, S390_KMAC_HMAC_Encrypted_SHA_512, 240)                    \
+   S390_DO_FUNC(127, S390_KMAC_Query_Authentication_Information, 256)
+
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
+static const UChar S390_KMAC_parms_len[] = {
+   S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #define S390_DO_FUNC(fc, name, plen) | S390_SETBIT(fc)
-static const ULong S390_KMAC_supported_fc[] = {0 S390_DO_FUNCTIONS};
+static const ULong S390_KMAC_supported_fc[] = {0 S390_DO_FUNCTIONS,
+                                               0 S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #undef S390_DO_FUNCTIONS
+#undef S390_DO_FUNCTIONS1
 
 static enum ExtensionError do_extension_KMAC(ThreadState* tst, ULong variant)
 {
    UChar r2        = (variant >> 4) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KMAC");
+   UInt  func      = READ_FUNCTION_CODE(tst, "KMAC", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KMAC(r1)", 1);
    ULong parms_len = 0;
@@ -1353,7 +1425,7 @@ static enum ExtensionError do_extension_KMAC(ThreadState* tst, ULong variant)
    ULong addr2 = 0, len2 = 0;
 
    if (fc < sizeof(S390_KMAC_parms_len) / sizeof(S390_KMAC_parms_len[0]))
-      parms_len = S390_KMAC_parms_len[fc];
+      parms_len = S390_KMAC_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KMAC: unknown function code\n");
 
@@ -1363,6 +1435,10 @@ static enum ExtensionError do_extension_KMAC(ThreadState* tst, ULong variant)
       s390_filter_functions((ULong*)parms, parms_len, S390_KMAC_supported_fc,
                             sizeof(S390_KMAC_supported_fc));
       POST_MEM_WRITE(tst, parms, parms_len);
+   } else if (fc == 127) { // Query authentication information
+      PRE_MEM_WRITE(tst, "KMAC(parms)", parms, parms_len);
+      cc = do_KMAC_insn(func, parms, &addr2, &len2);
+      POST_MEM_WRITE(tst, parms, parms_len);
    } else {
       addr2 = READ_GPR(tst, "KMAC(op2_addr)", r2);
       len2  = READ_GPR(tst, "KMAC(op2_len)", r2 + 1);
@@ -1391,6 +1467,7 @@ enum PCC_function_class {
    PCC_Compute_Last_Block_CMAC,
    PCC_Compute_XTS_Parameter,
    PCC_Scalar_Multiply,
+   PCC_Query_Authentication_Information,
 };
 
 #define S390_DO_FUNCTIONS                                                      \
@@ -1425,7 +1502,8 @@ enum PCC_function_class {
    S390_DO_FUNC(72, PCC_Scalar_Multiply, Ed25519, 64, 168)                     \
    S390_DO_FUNC(73, PCC_Scalar_Multiply, Ed448, 128, 328)                      \
    S390_DO_FUNC(80, PCC_Scalar_Multiply, X25519, 32, 104)                      \
-   S390_DO_FUNC(81, PCC_Scalar_Multiply, X448, 64, 200)
+   S390_DO_FUNC(81, PCC_Scalar_Multiply, X448, 64, 200)                        \
+   S390_DO_FUNC(127, PCC_Query_Authentication_Information, QAuth, 0, 256)
 
 #define S390_DO_FUNC(fc, class, name, rlen, plen)                              \
    [fc] = {class, rlen / 8, plen / 8},
@@ -1446,7 +1524,7 @@ static const ULong S390_PCC_supported_fc[] = {0 S390_DO_FUNCTIONS,
 
 static enum ExtensionError do_extension_PCC(ThreadState* tst, ULong variant)
 {
-   UChar func      = READ_FUNCTION_CODE(tst, "PCC");
+   UChar func      = READ_FUNCTION_CODE(tst, "PCC", UChar);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "PCC(r1)", 1);
    ULong parms_len = 0;
@@ -1468,6 +1546,12 @@ static enum ExtensionError do_extension_PCC(ThreadState* tst, ULong variant)
                             sizeof(S390_PCC_supported_fc));
       result_offs = 0;
       break;
+   case PCC_Query_Authentication_Information:
+      PRE_MEM_WRITE(tst, "PCC(parms)", parms, parms_len);
+      cc          = do_PCC_insn(func, parms);
+      result_offs = 0;
+      result_len  = parms_len;
+      break;
    case PCC_Compute_Last_Block_CMAC:
       /* result_len == sizeof(ICV) == sizeof(message) */
       PRE_MEM_READ(tst, "PCC(parms)", parms, 8);
@@ -1545,15 +1629,21 @@ S390_DEFINE_DO_RRR_INSN(do_KMCTR_insn, 0xb92d)
    S390_DO_FUNC(27, S390_KMCTR_Encrypted_AES_192, 56)                          \
    S390_DO_FUNC(28, S390_KMCTR_Encrypted_AES_256, 64)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
-static const UChar S390_KMCTR_parms_len[] = {S390_DO_FUNCTIONS};
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(127, S390_KMCTR_Query_Authentication_Information, 256)
+
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
+static const UChar S390_KMCTR_parms_len[] = {
+   S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #define S390_DO_FUNC(fc, name, plen) | S390_SETBIT(fc)
-static const ULong S390_KMCTR_supported_fc[] = {0 S390_DO_FUNCTIONS};
+static const ULong S390_KMCTR_supported_fc[] = {0 S390_DO_FUNCTIONS,
+                                                0 S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #undef S390_DO_FUNCTIONS
+#undef S390_DO_FUNCTIONS1
 
 enum {
    S390_KMCTR_parms_len_n =
@@ -1565,7 +1655,7 @@ static enum ExtensionError do_extension_KMCTR(ThreadState* tst, ULong variant)
    UChar r1        = variant & 0xf;
    UChar r2        = (variant >> 4) & 0xf;
    UChar r3        = (variant >> 8) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KMCTR");
+   UChar func      = READ_FUNCTION_CODE(tst, "KMCTR", UChar);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KMCTR(r1)", 1);
    ULong parms_len = 0;
@@ -1574,7 +1664,7 @@ static enum ExtensionError do_extension_KMCTR(ThreadState* tst, ULong variant)
    ULong addr1 = 0, addr2 = 0, addr3 = 0, len2 = 0, len3 = 0;
 
    if (fc < S390_KMCTR_parms_len_n)
-      parms_len = S390_KMCTR_parms_len[fc];
+      parms_len = S390_KMCTR_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KMCTR: unknown function code\n");
 
@@ -1584,6 +1674,10 @@ static enum ExtensionError do_extension_KMCTR(ThreadState* tst, ULong variant)
       s390_filter_functions((ULong*)parms, parms_len, S390_KMCTR_supported_fc,
                             sizeof(S390_KMCTR_supported_fc));
       POST_MEM_WRITE(tst, parms, parms_len);
+   } else if (fc == 127) { // Query authentication information
+      PRE_MEM_WRITE(tst, "KMCTR(parms)", parms, parms_len);
+      cc = do_KMCTR_insn(func, parms, &addr1, &addr2, &len2, &addr3, &len3);
+      POST_MEM_WRITE(tst, parms, parms_len);
    } else {
       addr1 = orig_addr1 = READ_GPR(tst, "KMCTR(op1_addr)", r1);
       addr2              = READ_GPR(tst, "KMCTR(op2_addr)", r2);
@@ -1608,7 +1702,7 @@ static enum ExtensionError do_extension_KMCTR(ThreadState* tst, ULong variant)
 /*--- KMO (cypher message with output feedback)               ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_RR_INSN(do_KMO_insn, 0xb92b)
+S390_DEFINE_DO_RR_INSN(do_KMO_insn, 0xb92b, "0")
 
 /* Same functions and parameter block sizes as for KMCTR */
 static const UChar* const S390_KMO_parms_len    = S390_KMCTR_parms_len;
@@ -1619,7 +1713,7 @@ static enum ExtensionError do_extension_KMO(ThreadState* tst, ULong variant)
 {
    UChar r1        = variant & 0xf;
    UChar r2        = (variant >> 4) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KMO");
+   UChar func      = READ_FUNCTION_CODE(tst, "KMO", UChar);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KMO(r1)", 1);
    ULong parms_len = 0;
@@ -1628,7 +1722,7 @@ static enum ExtensionError do_extension_KMO(ThreadState* tst, ULong variant)
    ULong addr1 = 0, len1 = 0, addr2 = 0, len2 = 0;
 
    if (fc < S390_KMO_parms_len_n)
-      parms_len = S390_KMO_parms_len[fc];
+      parms_len = S390_KMO_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KMO: unknown function code\n");
 
@@ -1637,6 +1731,8 @@ static enum ExtensionError do_extension_KMO(ThreadState* tst, ULong variant)
       cc = do_KMO_insn(func, parms, &addr1, &len1, &addr2, &len2);
       s390_filter_functions((ULong*)parms, parms_len, S390_KMO_supported_fc,
                             sizeof(S390_KMO_supported_fc));
+   } else if (fc == 127) { // Query authentication information
+      cc = do_KMO_insn(func, parms, &addr1, &len1, &addr2, &len2);
    } else {
       addr1 = orig_addr1 = READ_GPR(tst, "KMO(op1_addr)", r1);
       addr2              = READ_GPR(tst, "KMO(op2_addr)", r2);
@@ -1656,10 +1752,10 @@ static enum ExtensionError do_extension_KMO(ThreadState* tst, ULong variant)
 }
 
 /*---------------------------------------------------------------*/
-/*--- KMF (cypher message with output feedback)               ---*/
+/*--- KMF (cypher message with cypher feedback)               ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_RR_INSN(do_KMF_insn, 0xb92a)
+S390_DEFINE_DO_RR_INSN(do_KMF_insn, 0xb92a, "0")
 
 /* Same functions and parameter block sizes as for KMCTR */
 static const UChar* const S390_KMF_parms_len    = S390_KMCTR_parms_len;
@@ -1670,7 +1766,7 @@ static enum ExtensionError do_extension_KMF(ThreadState* tst, ULong variant)
 {
    UChar r1        = variant & 0xf;
    UChar r2        = (variant >> 4) & 0xf;
-   ULong func      = READ_GPR(tst, "KLMD(r0)", 0);
+   UInt  func      = READ_FUNCTION_CODE(tst, "KMF", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KMF(r1)", 1);
    ULong parms_len = 0;
@@ -1679,7 +1775,7 @@ static enum ExtensionError do_extension_KMF(ThreadState* tst, ULong variant)
    ULong addr1 = 0, len1 = 0, addr2 = 0, len2 = 0;
 
    if (fc < S390_KMF_parms_len_n)
-      parms_len = S390_KMF_parms_len[fc];
+      parms_len = S390_KMF_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KMF: unknown function code\n");
 
@@ -1688,6 +1784,8 @@ static enum ExtensionError do_extension_KMF(ThreadState* tst, ULong variant)
       cc = do_KMF_insn(func, parms, &addr1, &len1, &addr2, &len2);
       s390_filter_functions((ULong*)parms, parms_len, S390_KMF_supported_fc,
                             sizeof(S390_KMF_supported_fc));
+   } else if (fc == 127) { // Query authentication information
+      cc = do_KMF_insn(func, parms, &addr1, &len1, &addr2, &len2);
    } else {
       addr1 = orig_addr1 = READ_GPR(tst, "KMF(op1_addr)", r1);
       addr2              = READ_GPR(tst, "KMF(op2_addr)", r2);
@@ -1721,22 +1819,28 @@ S390_DEFINE_DO_RRR_INSN(do_KMA_insn, 0xb929)
    S390_DO_FUNC(27, S390_KMA_GCM_Encrypted_AES_192, 136)                       \
    S390_DO_FUNC(28, S390_KMA_GCM_Encrypted_AES_256, 144)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen,
-static const UChar S390_KMA_parms_len[] = {S390_DO_FUNCTIONS};
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(127, S390_KMA_Query_Authentication_Information, 256)
+
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
+static const UChar S390_KMA_parms_len[] = {
+   S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #define S390_DO_FUNC(fc, name, plen) | S390_SETBIT(fc)
-static const ULong S390_KMA_supported_fc[] = {0 S390_DO_FUNCTIONS};
+static const ULong S390_KMA_supported_fc[] = {0 S390_DO_FUNCTIONS,
+                                              0 S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #undef S390_DO_FUNCTIONS
+#undef S390_DO_FUNCTIONS1
 
 static enum ExtensionError do_extension_KMA(ThreadState* tst, ULong variant)
 {
    UChar r1        = variant & 0xf;
    UChar r2        = (variant >> 4) & 0xf;
    UChar r3        = (variant >> 8) & 0xf;
-   ULong func      = READ_GPR(tst, "KMA(gpr0)", 0);
+   UInt  func      = READ_FUNCTION_CODE(tst, "KMA(gpr0)", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KMA(r1)", 1);
    ULong parms_len = 0;
@@ -1745,7 +1849,7 @@ static enum ExtensionError do_extension_KMA(ThreadState* tst, ULong variant)
    ULong addr1 = 0, addr2 = 0, addr3 = 0, len2 = 0, len3 = 0;
 
    if (fc < sizeof(S390_KMA_parms_len) / sizeof(S390_KMA_parms_len[0]))
-      parms_len = S390_KMA_parms_len[fc];
+      parms_len = S390_KMA_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KMA: unknown function code\n");
 
@@ -1755,6 +1859,10 @@ static enum ExtensionError do_extension_KMA(ThreadState* tst, ULong variant)
       s390_filter_functions((ULong*)parms, parms_len, S390_KMA_supported_fc,
                             sizeof(S390_KMA_supported_fc));
       POST_MEM_WRITE(tst, parms, parms_len);
+   } else if (fc == 127) { // Query authentication information
+      PRE_MEM_WRITE(tst, "KMA(parms)", parms, parms_len);
+      cc = do_KMA_insn(func, parms, &addr1, &addr2, &len2, &addr3, &len3);
+      POST_MEM_WRITE(tst, parms, parms_len);
    } else {
       addr1 = orig_addr1 = READ_GPR(tst, "KMA(op1_addr)", r1);
       addr2              = READ_GPR(tst, "KMA(op2_addr)", r2);
@@ -1778,13 +1886,12 @@ static enum ExtensionError do_extension_KMA(ThreadState* tst, ULong variant)
 }
 
 /*---------------------------------------------------------------*/
-/*--- KDSA (compute intermediate message digest)              ---*/
+/*--- KDSA (compute digital signature authentication)         ---*/
 /*---------------------------------------------------------------*/
 
-S390_DEFINE_DO_0R_INSN(do_KDSA_insn, 0xb93a)
+S390_DEFINE_DO_0R_INSN(do_KDSA_insn, 0xb93a, "0")
 
-/* We specify the parameter block size without the CSB here.  Also note that
-   this approach only supports sizes that are a multiple of 8. */
+/* We specify the parameter block size without the CSB here. */
 #define S390_DO_FUNCTIONS                                                      \
    S390_DO_FUNC(0, S390_KDSA_Query, 16)                                        \
    S390_DO_FUNC(1, S390_KDSA_ECDSA_Verify_P256, 168)                           \
@@ -1803,12 +1910,17 @@ S390_DEFINE_DO_0R_INSN(do_KDSA_insn, 0xb93a)
    S390_DO_FUNC(48, S390_KDSA_Encrypted_EdDSA_Sign_Ed25519, 152)               \
    S390_DO_FUNC(52, S390_KDSA_Encrypted_EdDSA_Sign_Ed448, 248)
 
-#define S390_DO_FUNC(fc, name, plen) [fc] = plen / 8,
-static const UChar S390_KDSA_parms_len[] = {S390_DO_FUNCTIONS};
+#define S390_DO_FUNCTIONS1                                                     \
+   S390_DO_FUNC(127, S390_KDSA_Query_Authentication_Information, 256)
+
+#define S390_DO_FUNC(fc, name, plen) [fc] = S390_WORD_LEN(plen),
+static const UChar S390_KDSA_parms_len[] = {
+   S390_DO_FUNCTIONS S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #define S390_DO_FUNC(fc, name, plen) | S390_SETBIT(fc)
-static const ULong S390_KDSA_supported_fc[] = {0 S390_DO_FUNCTIONS};
+static const ULong S390_KDSA_supported_fc[] = {0 S390_DO_FUNCTIONS,
+                                               0 S390_DO_FUNCTIONS1};
 #undef S390_DO_FUNC
 
 #undef S390_DO_FUNCTIONS
@@ -1816,7 +1928,7 @@ static const ULong S390_KDSA_supported_fc[] = {0 S390_DO_FUNCTIONS};
 static enum ExtensionError do_extension_KDSA(ThreadState* tst, ULong variant)
 {
    UChar r2        = (variant >> 4) & 0xf;
-   UChar func      = READ_FUNCTION_CODE(tst, "KDSA");
+   UInt  func      = READ_FUNCTION_CODE(tst, "KDSA", UInt);
    UChar fc        = func & 0x7f;
    ULong parms     = READ_GPR(tst, "KDSA(r1)", 1);
    ULong parms_len = 0;
@@ -1824,7 +1936,7 @@ static enum ExtensionError do_extension_KDSA(ThreadState* tst, ULong variant)
    ULong addr2 = 0, len2 = 0;
 
    if (fc < sizeof(S390_KDSA_parms_len) / sizeof(S390_KDSA_parms_len[0]))
-      parms_len = S390_KDSA_parms_len[fc] * 8;
+      parms_len = S390_KDSA_parms_len[fc] * 4;
    if (parms_len == 0)
       return INSN_ERR("KDSA: unknown function code\n");
 
@@ -1834,6 +1946,10 @@ static enum ExtensionError do_extension_KDSA(ThreadState* tst, ULong variant)
       s390_filter_functions((ULong*)parms, parms_len, S390_KDSA_supported_fc,
                             sizeof(S390_KDSA_supported_fc));
       POST_MEM_WRITE(tst, parms, parms_len);
+   } else if (fc == 127) { // Query authentication information
+      PRE_MEM_WRITE(tst, "KDSA(parms)", parms, parms_len);
+      cc = do_KDSA_insn(func, parms, &addr2, &len2);
+      POST_MEM_WRITE(tst, parms, parms_len);
    } else {
       addr2 = READ_GPR(tst, "KDSA(op2_addr)", r2);
       len2  = READ_GPR(tst, "KDSA(op2_len)", r2 + 1);
diff --git a/coregrind/m_machine.c b/coregrind/m_machine.c
index a5168c89f1..7676b4353e 100644
--- a/coregrind/m_machine.c
+++ b/coregrind/m_machine.c
@@ -1572,7 +1572,7 @@ Bool VG_(machine_get_hwcaps)( void )
         UInt installed;
         const UInt facility_bit;
         const UInt hwcaps_bit;
-        const HChar name[5];   // may need adjustment for new facility names
+        const HChar name[6];   // may need adjustment for new facility names
      } fac_hwcaps[] = {
         { False, 129,  VEX_HWCAPS_S390X_VX,    "VX"    },
         { False,  57,  VEX_HWCAPS_S390X_MSA5,  "MSA5"  },
@@ -1587,6 +1587,7 @@ Bool VG_(machine_get_hwcaps)( void )
         { False, 155,  VEX_HWCAPS_S390X_MSA9,  "MSA9"  },
         { False,  61,  VEX_HWCAPS_S390X_MI3,   "MI3"   },
         { False, 198,  VEX_HWCAPS_S390X_VXE3,  "VXE3"  },
+        { False,  86,  VEX_HWCAPS_S390X_MSA12, "MSA12" },
      };
 
      /* Set hwcaps according to the detected facilities */

[Valgrind-developers] [valgrind] regtest: Support make regtest BUNSEN=no

[Florian K. <fk...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=980daf8169b059f9b78f8b3e4666a4eadf752be9

commit 980daf8169b059f9b78f8b3e4666a4eadf752be9
Author: Florian Krohm <fl...@ei...>
Date:   Wed Mar 4 22:23:18 2026 +0000

    regtest: Support make regtest BUNSEN=no
    
    Inhibits the generation of .log and .trs files which are only of use
    for post-processing with bunsen. For those of us who like tidy
    working copies.
    vg_regtest: New command line option --no-bunsen

Diff:
---
 Makefile.am         | 13 ++++++++++---
 NEWS                |  3 +++
 README_DEVELOPERS   |  3 ++-
 tests/vg_regtest.in | 15 +++++++++++++--
 4 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/Makefile.am b/Makefile.am
index 3f38a6ba35..674ad64469 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -68,6 +68,13 @@ pkgconfig_DATA = valgrind.pc
 BUILT_SOURCES  = default.supp include/vgversion.h valgrind.pc
 CLEANFILES     = default.supp
 
+BUNSEN ?= yes
+ ifeq "$(BUNSEN)" "no"
+  VG_REGTEST_ARG ?= "--no-bunsen"
+ else
+  VG_REGTEST_ARG ?=
+ endif
+
 default.supp: $(DEFAULT_SUPP_FILES)
 	echo "# This is a generated file, composed of the following suppression rules:" > default.supp
 	echo "# " $(DEFAULT_SUPP_FILES) >> default.supp
@@ -76,7 +83,7 @@ default.supp: $(DEFAULT_SUPP_FILES)
 ## Ensure make exits with error if vg_regtest fails or post_regtest_checks fails.
 regtest: check
 	$(top_srcdir)/gdbserver_tests/make_local_links $(GDB)
-	if tests/vg_regtest gdbserver_tests $(TOOLS) $(EXP_TOOLS) ; then \
+	if tests/vg_regtest $(VG_REGTEST_ARG) gdbserver_tests $(TOOLS) $(EXP_TOOLS) ; then \
 	   tests/post_regtest_checks $(abs_top_srcdir) gdbserver_tests $(TOOLS) $(EXP_TOOLS); \
 	else \
 	   tests/post_regtest_checks $(abs_top_srcdir) gdbserver_tests $(TOOLS) $(EXP_TOOLS); \
@@ -85,9 +92,9 @@ regtest: check
 post-regtest-checks:
 	tests/post_regtest_checks $(abs_top_srcdir) gdbserver_tests $(TOOLS) $(EXP_TOOLS)
 nonexp-regtest: check
-	tests/vg_regtest $(TOOLS)
+	tests/vg_regtest $(VG_REGTEST_ARG) $(TOOLS)
 exp-regtest: check
-	tests/vg_regtest gdbserver_tests $(EXP_TOOLS)
+	tests/vg_regtest $(VG_REGTEST_ARG) gdbserver_tests $(EXP_TOOLS)
 # Nb: gdbserver_tests are put in exp-regtest rather than nonexp-regtest
 # because they are tested with various valgrind tools, so might be using
 # an experimental tool.
diff --git a/NEWS b/NEWS
index 5bbbd812b0..25aa565101 100644
--- a/NEWS
+++ b/NEWS
@@ -125,6 +125,9 @@ X86/macOS 10.13, AMD64/macOS 10.13 and nanoMIPS/Linux.
   documentation.  all, builds all documentation. html, builds HTML
   docs but skips building PDFs. See also README_DEVELOPERS.
 
+* Control generation of files that are only useful for post-processing
+  with bunsen. make regtest BUNSEN=no inhibits generating those files.
+
 * New VEX API function LibVEX_set_VexControl
 
 * The deprecated IROps: Iop_Clz32/64 and Iop_Ctz32/64 have been removed
diff --git a/README_DEVELOPERS b/README_DEVELOPERS
index 5d9fb823f9..286ed3b52c 100644
--- a/README_DEVELOPERS
+++ b/README_DEVELOPERS
@@ -68,7 +68,8 @@ files.  These are listed, and non-passing tests detailed, in the
 test-suite-overall.log file.  (Token *.trs and test-suite.log files
 are also created, for emulating automake-style testsuites, as expected
 by tools such as bunsen.)
-
+Generation of those files can be suppressed by specifying "BUNSEN=no" when
+invoking make.
 
 Platform-specific setup for regression tests
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/tests/vg_regtest.in b/tests/vg_regtest.in
index 6ef0b71071..2c4fe8c074 100644
--- a/tests/vg_regtest.in
+++ b/tests/vg_regtest.in
@@ -47,6 +47,7 @@
 #   --loop-till-fail: loops on the test(s) till one fail, then exit
 #              This is useful to obtain detailed trace or --keep-unfiltered
 #              output of a non deterministic test failure
+#   --no-bunsen: do not generate files for bunsen post-processing
 #
 # The easiest way is to run all tests in valgrind/ with (assuming you installed
 # in $PREFIX):
@@ -140,7 +141,7 @@ my $usage="\n"
      . "Usage:\n"
      . "   vg_regtest [--all, --valgrind, --valgrind-lib, --keep-unfiltered\n"
      . "                 --outer-valgrind, --outer-tool, --outer-args\n"
-     . "                 --loop-till-fail]\n"
+     . "                 --loop-till-fail --no-bunsen]\n"
      . "   Use EXTRA_REGTEST_OPTS to supply extra args for all tests\n"
      . "\n";
 
@@ -174,6 +175,7 @@ my %num_failures        = (stderr => 0, stdout => 0,
                            stderrB => 0, stdoutB => 0,
                            post => 0);
 my %num_results         = ();
+my $no_bunsen           = 0;
 
 # Default valgrind to use is this build tree's (uninstalled) one
 my $valgrind = "./coregrind/valgrind";
@@ -252,6 +254,8 @@ sub process_command_line()
                 $keepunfiltered = 1;
             } elsif ($arg =~ /^--loop-till-fail$/) {
                 $looptillfail = 1;
+            } elsif ($arg =~ /^--no-bunsen$/) {
+                $no_bunsen = 1;
             } else {
                 die $usage;
             }
@@ -511,6 +515,7 @@ sub do_one_test($$)
             printf("%-16s (skipping, prereq failed: $prereq)\n", "$name:");
             print VGTESTLOG scalar localtime, " skipping, prereq failed\n";
             close(VGTESTLOG);
+            unlink("$vgtest.log") if ($no_bunsen);
             return "SKIP";
         } else {
             # Bad prereq; abort.
@@ -692,6 +697,7 @@ sub do_one_test($$)
 
     close(VGTESTLOG);
     $num_tests_done++;
+    unlink("$vgtest.log") if ($no_bunsen);
     return $rc;
 }
 
@@ -745,10 +751,11 @@ sub test_one_dir($$)
             print TSDIRLOG "See $tests_dir/test-suite-overall.log\n";
             print TSDIRLOG "    for overall results, including all non-PASS .log contents.\n";
             close(TSDIRLOG);
+            unlink("test-suite.log") if ($no_bunsen);
             my $result = do_one_test($full_dir, $f);
             print TSLOG scalar localtime, " result: $result $full_dir/$f.log\n";
             $num_results{$result} ++;
-            if ($result ne "PASS") {
+            if ($result ne "PASS" && $no_bunsen == 0) {
                # transcribe .log file into the overall log.
                open(LOGFILE, "< $f.log") || die "Cannot open $f.log";
                while (<LOGFILE>) { print TSLOG "|\t$_"; }
@@ -760,6 +767,7 @@ sub test_one_dir($$)
             print VGTESTTRS ":recheck: no\n"; # ?
             print VGTESTTRS ":copy-in-global-log: no\n"; # ?
             close(VGTESTTRS);
+            unlink ("$f.trs") if ($no_bunsen);
         }
     }
     if ($found_tests) {
@@ -863,6 +871,7 @@ while (1) { # we will exit after one loop, unless looptillfail
             print VGTESTTRS ":recheck: no\n"; # ?
             print VGTESTTRS ":copy-in-global-log: no\n"; # ?
             close(VGTESTTRS);
+            unlink ("$f.trs") if ($no_bunsen);
         }
         chdir($tests_dir);
     }
@@ -876,6 +885,8 @@ if ($ENV{"EXTRA_REGTEST_OPTS"}) {
     warn_about_EXTRA_REGTEST_OPTS();
 }
 
+unlink("test-suite-overall.log") if ($no_bunsen);
+
 if (0 == $num_failures{"stdout"} &&
     0 == $num_failures{"stderr"} &&
     0 == $num_failures{"stdoutB"} &&

[Valgrind-developers] [valgrind] NEWS: Fix typos.

[Florian K. <fk...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=efe62f43bbbb76d6d0d57e92174fc0bd279cf84c

commit efe62f43bbbb76d6d0d57e92174fc0bd279cf84c
Author: Florian Krohm <fl...@ei...>
Date:   Wed Mar 4 22:12:54 2026 +0000

    NEWS: Fix typos.

Diff:
---
 NEWS | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/NEWS b/NEWS
index 57184fac95..5bbbd812b0 100644
--- a/NEWS
+++ b/NEWS
@@ -31,11 +31,11 @@ for nanoMIPS/Linux. macOS is supported up to version 12 Monterey (amd64 only).
 s390x: Machine models older than z196 are no longer supported.
 
 Support for the following macOS versions has been added
-10,13 High Sierra (bug fixes)
+10.13 High Sierra (bug fixes)
 10.14 Mojave
-10.15 Calalina
+10.15 Catalina
 11.0  Big Sur (Intel only)
-12.0  Monterey (intel only)
+12.0  Monterey (Intel only)
 
 * ==================== TOOL CHANGES ===================
 
@@ -63,7 +63,6 @@ are not entered into bugzilla tend to get forgotten about or ignored.
 510416  Missing syswraps for file_getattr and file_setattr
 510563  Add missing syswraps for lsm_get_self_attr and lsm_set_self_attr
 510864  Add SSE4.1 PMAXSD and PMINSD instructions support for 32-bit x86
-512873  Add SSE4.1 min/max instructions for x86 32 bit
 511329  Darwin and FreeBSD: Move setting of carry flag out of
         ML_(do_syscall_for_client_WRK)
 511713  Refactor syscall argument handling
@@ -75,6 +74,7 @@ are not entered into bugzilla tend to get forgotten about or ignored.
 512030  s390x: bfp-convert testcase fails
 512037  malloc trace does not print free size or alignment
 512571  regtest problems with darwin dsymutil
+512873  Add SSE4.1 min/max instructions for x86 32 bit
 513257  Add missing syswraps for lsm_list_modules
 513522  m_libcassert.c: 'ordered comparison of pointer with integer zero'
         compiler warning

[Valgrind-developers] [valgrind] Clean up initimg-freebsd ascii stack drawing and rationalise darwin VG_STACK_REDZONE_SZB etc

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=6b72038aa52c36112e8c2cff1b6542f88a4d9196

commit 6b72038aa52c36112e8c2cff1b6542f88a4d9196
Author: Paul Floyd <pj...@wa...>
Date:   Wed Mar 4 13:10:06 2026 +0100

    Clean up initimg-freebsd ascii stack drawing and rationalise darwin VG_STACK_REDZONE_SZB etc
    
    VG_STACK_REDZONE_SZB and related have the same groups of values on x86 and amd64.
    Darwin had duplicate definitions so I stuck them all together.
    
    values

Diff:
---
 coregrind/m_initimg/initimg-freebsd.c |  6 +++++-
 include/pub_tool_machine.h            | 17 ++---------------
 2 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/coregrind/m_initimg/initimg-freebsd.c b/coregrind/m_initimg/initimg-freebsd.c
index 9e95bbfa0c..33a81fb814 100644
--- a/coregrind/m_initimg/initimg-freebsd.c
+++ b/coregrind/m_initimg/initimg-freebsd.c
@@ -542,7 +542,7 @@ static Addr setup_client_stack(const void*  init_sp,
    higher address +-----------------+ <- clstack_end    ^                ^
                   | args env auxv   |                   |                |
                   |   see above     |                   |                |
-    ower address  +-----------------+ <- client_SP   anon_size           |
+   lower address  +-----------------+ <- client_SP   anon_size           |
                   |  round to page  |                   |                |
                   +-----------------+ <- clstack_start  |                |
                   |    one page     |                   |           clstack_max_size
@@ -552,6 +552,10 @@ static Addr setup_client_stack(const void*  init_sp,
                   :                 :                   |                |
                   +-----------------+ <- resvn_start    v                v
 
+(The "one page" below clstack_start is only present when VG_STACK_REDZONE_SZB
+is not zero, which for FreeBSD is only on amd64. This page is not present
+on other platforms.)
+
    */
 
    {
diff --git a/include/pub_tool_machine.h b/include/pub_tool_machine.h
index c3d55efcba..b4f18951f2 100644
--- a/include/pub_tool_machine.h
+++ b/include/pub_tool_machine.h
@@ -32,14 +32,14 @@
 #include "pub_tool_basics.h"           // ThreadID
 #include "libvex.h"                    // VexArchInfo
 
-#if defined(VGP_x86_linux) || defined(VGP_x86_solaris) || defined(VGP_x86_freebsd)
+#if defined(VGP_x86_linux) || defined(VGP_x86_solaris) || defined(VGP_x86_freebsd) || defined(VGP_x86_darwin)
 #  define VG_MIN_INSTR_SZB          1  // min length of native instruction
 #  define VG_MAX_INSTR_SZB         16  // max length of native instruction
 #  define VG_CLREQ_SZB             14  // length of a client request, may
                                        //   be larger than VG_MAX_INSTR_SZB
 #  define VG_STACK_REDZONE_SZB      0  // number of addressable bytes below %RSP
 
-#elif defined(VGP_amd64_linux) || defined(VGP_amd64_solaris) || defined(VGP_amd64_freebsd)
+#elif defined(VGP_amd64_linux) || defined(VGP_amd64_solaris) || defined(VGP_amd64_freebsd) || defined(VGP_amd64_darwin)
 #  define VG_MIN_INSTR_SZB          1
 #  define VG_MAX_INSTR_SZB         16
 #  define VG_CLREQ_SZB             19
@@ -77,19 +77,6 @@
 #  define VG_CLREQ_SZB             10
 #  define VG_STACK_REDZONE_SZB      0  // s390 has no redzone
 
-#elif defined(VGP_x86_darwin)
-#  define VG_MIN_INSTR_SZB          1  // min length of native instruction
-#  define VG_MAX_INSTR_SZB         16  // max length of native instruction
-#  define VG_CLREQ_SZB             14  // length of a client request, may
-                                       //   be larger than VG_MAX_INSTR_SZB
-#  define VG_STACK_REDZONE_SZB      0  // number of addressable bytes below %RSP
-
-#elif defined(VGP_amd64_darwin)
-#  define VG_MIN_INSTR_SZB          1
-#  define VG_MAX_INSTR_SZB         16
-#  define VG_CLREQ_SZB             19
-#  define VG_STACK_REDZONE_SZB    128
-
 #elif defined(VGP_mips32_linux)
 #  define VG_MIN_INSTR_SZB          4
 #  define VG_MAX_INSTR_SZB          8

[Valgrind-developers] [valgrind] s390: Print guest register names symbolically

[Florian K. <fk...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=221598bf828fcafb0891d20ae3407ecfdf7821d1

commit 221598bf828fcafb0891d20ae3407ecfdf7821d1
Author: Florian Krohm <fl...@ei...>
Date:   Wed Mar 4 11:12:50 2026 +0000

    s390: Print guest register names symbolically
    
    This is quite convenient when looking at VEX traces obtained during
    insn selection and register allocation.
    
    Today this looks like this:
    ------------------------ Register-allocated code ------------------------
    
      0   v-evcheck counter = 804(%r13), fail-addr = 808(%r13)
      1   v-test   1424(%r13)             8 bytes
      2   v-call   if (not equal) MC_(helperc_value_check0_fail_no_o){0x8000100C0}()
      3   v-loadi  %r5,0                  8 bytes
      4   v-cmpu   %r5,608(%r13)          8 bytes
      5   v-xdirect if (not equal) 720(%r13) = 0x4038182  fast
      6   v-xdirect if (always) 720(%r13) = 0x4038190  fast
    
    With the change:
    ------------------------ Register-allocated code ------------------------
    
      0   v-evcheck counter = guest_EvC_COUNTER, fail-addr = guest_EvC_FAILADDR
      1   v-test   shadow1_r4             8 bytes
      2   v-call   if (not equal) MC_(helperc_value_check0_fail_no_o){0x800010060}()
      3   v-loadi  %r5,0                  8 bytes
      4   v-cmpu   %r5,guest_r4           8 bytes
      5   v-xdirect if (not equal) guest_IA = 0x4038182  fast
      6   v-xdirect if (always) guest_IA = 0x4038190  fast
    
    Guest registers are now written out symbolically:
    1424(%r13) becomes shadow1_r4
    608(%r13)  becomes guest_r4
    720(%r13)  becomes guest_IA
    
    The new behaviour is enabled by default but can be controlled at compile
    time by defining SYMBOLIC_REGNAMES as desired.

Diff:
---
 VEX/priv/host_s390_defs.c | 130 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 125 insertions(+), 5 deletions(-)

diff --git a/VEX/priv/host_s390_defs.c b/VEX/priv/host_s390_defs.c
index 2c94eb0eb9..58c891878b 100644
--- a/VEX/priv/host_s390_defs.c
+++ b/VEX/priv/host_s390_defs.c
@@ -41,6 +41,9 @@
 #include "s390_disasm.h"
 #include "guest_s390_defs.h"    /* S390X_GUEST_OFFSET */
 
+/* Whether or not names of guest registers should be written symbolically. */
+#define SYMBOLIC_REGNAMES 1
+
 /*------------------------------------------------------------*/
 /*--- Forward declarations                                 ---*/
 /*------------------------------------------------------------*/
@@ -48,6 +51,7 @@
 static void s390_insn_map_regs(HRegRemap *, s390_insn *);
 static void s390_insn_get_reg_usage(HRegUsage *u, const s390_insn *);
 static UInt s390_tchain_load64_len(void);
+static const HChar *s390_guest_regname(UInt);
 
 
 /*------------------------------------------------------------*/
@@ -293,15 +297,26 @@ s390_amode_as_string(const s390_amode *am)
    switch (am->tag) {
    case S390_AMODE_B12:
    case S390_AMODE_B20:
-      vex_sprintf(p, "%d(%s)", am->d, s390_hreg_as_string(am->b));
+      if (SYMBOLIC_REGNAMES &&
+          hregNumber(am->b) == S390_REGNO_GUEST_STATE_POINTER) {
+         vex_sprintf(p, "%s", s390_guest_regname(am->d));
+      } else {
+         vex_sprintf(p, "%d(%s)", am->d, s390_hreg_as_string(am->b));
+      }
       break;
 
    case S390_AMODE_BX12:
    case S390_AMODE_BX20:
-      /* s390_hreg_as_string returns pointer to local buffer. Need to
-         split this into two printfs */
-      p += vex_sprintf(p, "%d(%s,", am->d, s390_hreg_as_string(am->x));
-      vex_sprintf(p, "%s)", s390_hreg_as_string(am->b));
+      if (SYMBOLIC_REGNAMES &&
+          hregNumber(am->b) == S390_REGNO_GUEST_STATE_POINTER &&
+          hregNumber(am->x) == 0) {
+         vex_sprintf(p, "%s", s390_guest_regname(am->d));
+      } else {
+         /* s390_hreg_as_string returns a pointer to a static buffer.
+            Need to split this into two printfs */
+         p += vex_sprintf(p, "%d(%s,", am->d, s390_hreg_as_string(am->x));
+         vex_sprintf(p, "%s)", s390_hreg_as_string(am->b));
+      }
       break;
 
    default:
@@ -5888,6 +5903,111 @@ s390_insn_vec_replicate(UChar size, HReg dst, HReg op1, UChar idx)
 /*--- Debug print                                             ---*/
 /*---------------------------------------------------------------*/
 
+/* Convenience macro to test whether OFFSET lies within the interval
+   [FROM, TO] */
+#define in_range(offset, from, to) \
+   ((offset) >= S390X_GUEST_OFFSET(from) && \
+    (offset) <= S390X_GUEST_OFFSET(to))
+
+static const HChar *
+s390_guest_regname_WRK(UInt offset, const HChar *prefix)
+{
+   static HChar buf[30];  /* large enough */
+   UInt regno;
+
+   vassert(vex_strlen(prefix) < 10); /* precaution against buffer overflow */
+
+   if (vex_streq(prefix, "spill")) {
+      vex_sprintf(buf, "%s_%u", prefix, offset);
+   } else if (in_range(offset, guest_a0, guest_a15)) {
+      regno = (offset - S390X_GUEST_OFFSET(guest_a0)) / 4;
+      vex_sprintf(buf, "%s_a%u",  prefix, regno);
+   } else if (in_range(offset, guest_r0, guest_r15)) {
+      regno = (offset - S390X_GUEST_OFFSET(guest_r0)) / 8;
+      vex_sprintf(buf, "%s_r%u",  prefix, regno);
+   } else if (in_range(offset, guest_v0, guest_v31)) {
+      regno = (offset - S390X_GUEST_OFFSET(guest_v0)) / 16;
+      vex_sprintf(buf, "%s_v%u",  prefix, regno);
+   } else if (vex_streq(prefix, "spill")) {
+      vex_sprintf(buf, "%s_%u", prefix, offset);
+   } else {
+
+#define NUM_SPECIAL_REGS (sizeof special_regs / sizeof special_regs[0])
+#define SPECIAL_REG_NAME(prefix,name) #name
+#define SPECIAL_REG_OFFSET(prefix,name) S390X_GUEST_OFFSET(prefix##_##name)
+#define SPECIAL_REG_NBYTES(prefix,name) (sizeof((VexGuestS390XState *)0)->prefix##_##name)
+
+#define SPECIAL_REG(prefix,name)              \
+            SPECIAL_REG_NAME(prefix, name),   \
+            SPECIAL_REG_OFFSET(prefix, name), \
+            SPECIAL_REG_NBYTES(prefix, name)
+      static const struct {
+         const HChar *name;
+         const UInt  offset;
+         const UInt  nbytes;
+      } special_regs[] = {
+         { SPECIAL_REG(guest, counter) },
+         { SPECIAL_REG(guest, fpc)     },
+         { SPECIAL_REG(guest, IA)      },
+         { SPECIAL_REG(guest, SYSNO)   },
+         { SPECIAL_REG(guest, CC_OP)   },
+         { SPECIAL_REG(guest, CC_DEP1) },
+         { SPECIAL_REG(guest, CC_DEP2) },
+         { SPECIAL_REG(guest, CC_NDEP) },
+         { SPECIAL_REG(guest, NRADDR)  },
+         { SPECIAL_REG(guest, CMSTART) },
+         { SPECIAL_REG(guest, CMLEN)   },
+         { SPECIAL_REG(guest, IP_AT_SYSCALL) },
+         { SPECIAL_REG(guest, EMNOTE) },
+         { SPECIAL_REG(host, EvC_COUNTER)  },
+         { SPECIAL_REG(host, EvC_FAILADDR) },
+      };
+
+      Int found = 0;
+      for (UInt i = 0; i < NUM_SPECIAL_REGS; ++i) {
+         if (offset >= special_regs[i].offset &&
+            offset < special_regs[i].offset + special_regs[i].nbytes ) {
+            vex_sprintf(buf, "%s_%s", prefix, special_regs[i].name);
+            found = 1;
+            break;
+         }
+      }
+      if (! found)
+         vex_sprintf(buf, "%s_%u ???", prefix, offset);
+   }
+
+   return buf;
+}
+
+
+/* Construct a symbolic name for a guest register. The name is constructed
+   in a static array which will be overwritten on every invocation. You
+   have been warned. */
+static const HChar *
+s390_guest_regname(UInt offset)
+{
+   if (offset < sizeof(VexGuestS390XState))
+      return s390_guest_regname_WRK(offset, "guest");
+
+   if (offset >= sizeof(VexGuestS390XState) &&
+       offset < 2*sizeof(VexGuestS390XState)) {
+      offset -= sizeof(VexGuestS390XState);
+      return s390_guest_regname_WRK(offset, "shadow1");
+   }
+   if (offset >= 2*sizeof(VexGuestS390XState) &&
+       offset < 3*sizeof(VexGuestS390XState)) {
+      offset -= 2*sizeof(VexGuestS390XState);
+      return s390_guest_regname_WRK(offset, "shadow2");
+   }
+   if (offset >= 3*sizeof(VexGuestS390XState) &&
+       offset < 3*sizeof(VexGuestS390XState) + LibVEX_N_SPILL_BYTES) {
+      offset -= 3*sizeof(VexGuestS390XState);
+      return s390_guest_regname_WRK(offset, "spill");
+   }
+   vpanic("s390_guest_regname");
+}
+
+
 static const HChar *
 s390_cc_as_string(s390_cc_t cc)
 {

[Valgrind-developers] [valgrind] Bug 390754 - unhandled amd64-darwin syscall: unix:216 (open_dprotected_np)

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=f26704c0fe412d002ef280cbc9a3b42381469c3a

commit f26704c0fe412d002ef280cbc9a3b42381469c3a
Author: Paul Floyd <pj...@wa...>
Date:   Tue Mar 3 14:02:16 2026 +0100

    Bug 390754 - unhandled amd64-darwin syscall: unix:216 (open_dprotected_np)

Diff:
---
 NEWS                                      |  1 +
 coregrind/m_syswrap/priv_syswrap-darwin.h |  2 +-
 coregrind/m_syswrap/syswrap-darwin.c      | 82 ++++++++++++++++++++++++++++---
 include/vki/vki-scnums-darwin.h           |  2 +-
 4 files changed, 79 insertions(+), 8 deletions(-)

diff --git a/NEWS b/NEWS
index eee47e3402..57184fac95 100644
--- a/NEWS
+++ b/NEWS
@@ -54,6 +54,7 @@ are not entered into bugzilla tend to get forgotten about or ignored.
 233298  MEMPOOL_FREE not reflected in heap summary
 253436  vex amd64->IR: unhandled instruction bytes: 0xF2 0xA6 (repne cmps)
 258140  Valgrind on OS X always reports some memory "still reachable"
+390754  unhandled amd64-darwin syscall: unix:216 (open_dprotected_np)
 406674  False positive when reading bitfield value on code compiled with
         clang 7.0
 413369  unhandled amd64-darwin syscall: unix:151 (getpgid)
diff --git a/coregrind/m_syswrap/priv_syswrap-darwin.h b/coregrind/m_syswrap/priv_syswrap-darwin.h
index f80b007fae..dc21bebeb1 100644
--- a/coregrind/m_syswrap/priv_syswrap-darwin.h
+++ b/coregrind/m_syswrap/priv_syswrap-darwin.h
@@ -274,7 +274,7 @@ DECL_TEMPLATE(darwin, __sysctl);                // 202
 // 213  Reserved for AppleTalk
 // NYI kqueue_from_portset_np 214
 // NYI kqueue_portset_np 215
-// NYI mkcomplex 216
+DECL_TEMPLATE(darwin, open_dprotected_np)       // 216
 // NYI statv 217
 // NYI lstatv 218
 // NYI fstatv 219
diff --git a/coregrind/m_syswrap/syswrap-darwin.c b/coregrind/m_syswrap/syswrap-darwin.c
index 1a474bb94f..668f2ef029 100644
--- a/coregrind/m_syswrap/syswrap-darwin.c
+++ b/coregrind/m_syswrap/syswrap-darwin.c
@@ -3626,6 +3626,43 @@ static void set1attr(ThreadId tid, void *attrData, SizeT attrDataSize)
    PRE_MEM_READ("setattrlist(attrBuf value)", (Addr)attrData, attrDataSize);
 }
 
+// __NR_open_dprotected_np    VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(216)
+// int open_dprotected_np(const char *path, int flags, int dpclass,
+//                                int dpflags, int mode);
+PRE(open_dprotected_np)
+{
+    if (ARG2 & VKI_O_CREAT) {
+        // versiion that uses mode
+        PRINT("open_dprotected_np(path:%#lx(%s), flags:%#lx, "
+              "dpclass:%#lx, dpflags:%#lx, mode:%#lx)",
+            ARG1, (HChar*)ARG1, ARG2, ARG3, ARG4, ARG5);
+        PRE_REG_READ5(int, "open_dprotected_np", const char*, path,
+                      int, flags, int, dpclass, int, dpflags,
+                      int, mode);
+    } else {
+        // version that does not use mode
+        PRINT("open_dprotected_np(path:%#lx(%s), flags:%#lx, "
+              "dpclass:%#lx, dpflags:%#lx)",
+              ARG1, (HChar*)ARG1, ARG2, ARG3, ARG4);
+        PRE_REG_READ4(int, "open_dprotected_np", const char*, path,
+                      int, flags, int, dpclass, int, dpflags);
+    }
+    PRE_MEM_RASCIIZ("open_dprotected_np(path)", ARG1);
+}
+
+POST(open_dprotected_np)
+{
+    vg_assert(SUCCESS);
+    POST_newFd_RES;
+    if (!ML_(fd_allowed)(RES, "open_dprotected_np", tid, True)) {
+        VG_(close)(RES);
+        SET_STATUS_Failure( VKI_EMFILE );
+    } else {
+        if (VG_(clo_track_fds))
+            ML_(record_fd_open_with_given_name)(tid, RES, (HChar*)(Addr)ARG1);
+     }
+}
+
 PRE(getattrlist)
 {
    PRINT("getattrlist(%#lx(%s), %#lx, %#lx, %lu, %lu)", 
@@ -10445,12 +10482,45 @@ POST(csrctl)
    }
 }
 
+// __NR_guarded_open_dprotected_np    VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(484)
+// int guarded_open_dprotected_np(const char *path, const void *guard,
+//                                u_int guardflags, int flags, int dpclass,
+//                                int dpflags, int mode);
 PRE(guarded_open_dprotected_np)
 {
-    PRINT("guarded_open_dprotected_np("
-        "path:%#lx(%s), guard:%#lx, guardflags:%#lx, flags:%#lx, "
-        "dpclass:%#lx, dpflags: %#lx) FIXME",
-        ARG1, (HChar*)ARG1, ARG2, ARG3, ARG4, ARG5, ARG6);
+    if (ARG4 & VKI_O_CREAT) {
+        // versiion that uses mode
+        PRINT("guarded_open_dprotected_np("
+            "path:%#lx(%s), guard:%#lx, guardflags:%#lx, flags:%#lx, "
+            "dpclass:%#lx, dpflags:%#lx, mode:%#lx)",
+            ARG1, (HChar*)ARG1, ARG2, ARG3, ARG4, ARG5, ARG6, ARG7);
+        PRE_REG_READ7(int, "guarded_open_dprotected_np", const char*, path,
+                      const void*, guard, u_int, guardflags, int, flags,
+                      int, dpclass, int, dpflags, int, mode);
+    } else {
+        // version that does not use mode
+        PRINT("guarded_open_dprotected_np("
+            "path:%#lx(%s), guard:%#lx, guardflags:%#lx, flags:%#lx, "
+            "dpclass:%#lx, dpflags:%#lx)",
+            ARG1, (HChar*)ARG1, ARG2, ARG3, ARG4, ARG5, ARG6);
+        PRE_REG_READ6(int, "guarded_open_dprotected_np", const char*, path,
+                      const void*, guard, u_int, guardflags, int, flags,
+                      int, dpclass, int, dpflags);
+    }
+    PRE_MEM_RASCIIZ("guarded_open_dprotected_np(path)", ARG1);
+}
+
+POST(guarded_open_dprotected_np)
+{
+    vg_assert(SUCCESS);
+    POST_newFd_RES;
+    if (!ML_(fd_allowed)(RES, "guarded_open_dprotected_np", tid, True)) {
+        VG_(close)(RES);
+        SET_STATUS_Failure( VKI_EMFILE );
+    } else {
+        if (VG_(clo_track_fds))
+            ML_(record_fd_open_with_given_name)(tid, RES, (HChar*)(Addr)ARG1);
+     }
 }
 
 PRE(guarded_write_np)
@@ -11524,7 +11594,7 @@ const SyscallTableEntry ML_(syscall_table)[] = {
 // _____(__NR_kqueue_from_portset_np), 
 // _____(__NR_kqueue_portset_np), 
 #endif
-// _____(__NR_mkcomplex), 
+    MACXY(__NR_open_dprotected_np, open_dprotected_np),   // 216
 // _____(__NR_statv), 
 // _____(__NR_lstatv), 
 // _____(__NR_fstatv), 
@@ -11830,7 +11900,7 @@ const SyscallTableEntry ML_(syscall_table)[] = {
    MACX_(__NR_mkdirat,             mkdirat),            // 475
    MACX_(__NR_bsdthread_ctl,       bsdthread_ctl),      // 478
    MACXY(__NR_csrctl,              csrctl),             // 483
-   MACX_(__NR_guarded_open_dprotected_np, guarded_open_dprotected_np),  // 484
+   MACXY(__NR_guarded_open_dprotected_np, guarded_open_dprotected_np),  // 484
    MACX_(__NR_guarded_write_np, guarded_write_np),      // 485
    MACX_(__NR_guarded_pwrite_np, guarded_pwrite_np),    // 486
    MACX_(__NR_guarded_writev_np, guarded_writev_np),    // 487
diff --git a/include/vki/vki-scnums-darwin.h b/include/vki/vki-scnums-darwin.h
index d6cfe56e60..904bf21238 100644
--- a/include/vki/vki-scnums-darwin.h
+++ b/include/vki/vki-scnums-darwin.h
@@ -475,7 +475,7 @@
 #define __NR_kqueue_from_portset_np VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(214)
 #define __NR_kqueue_portset_np VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(215)
 #endif
-#define	__NR_mkcomplex      VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(216)
+#define	__NR_open_dprotected_np VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(216)
 #define	__NR_statv          VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(217)
 #define	__NR_lstatv         VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(218)
 #define	__NR_fstatv         VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(219)

[Valgrind-developers] [valgrind] Simplify condition in VG_(post_syscall)

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=5cc956666e4421e2d52772182132778e5c0b9507

commit 5cc956666e4421e2d52772182132778e5c0b9507
Author: Paul Floyd <pj...@wa...>
Date:   Tue Mar 3 12:46:45 2026 +0100

    Simplify condition in VG_(post_syscall)

Diff:
---
 coregrind/m_syswrap/syswrap-main.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-main.c b/coregrind/m_syswrap/syswrap-main.c
index 763833c526..3342ff3b49 100644
--- a/coregrind/m_syswrap/syswrap-main.c
+++ b/coregrind/m_syswrap/syswrap-main.c
@@ -2647,9 +2647,7 @@ void VG_(post_syscall) (ThreadId tid)
    */
    ent = get_syscall_entry(canonical_sysno);
    if (ent->after
-       && ((!sr_isError(sci->status.sres))
-           || (sr_isError(sci->status.sres)
-               && (sci->flags & SfPostOnFail) ))) {
+       && (!sr_isError(sci->status.sres) || (sci->flags & SfPostOnFail))) {
 
       (ent->after)( tid, &sci->args, &sci->status );
    }

[Valgrind-developers] [valgrind] Darwin syscall: sigwait arguments are not optionally NULL

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=fff12b8fc432371c04b836fb6881b2ed73936aef

commit fff12b8fc432371c04b836fb6881b2ed73936aef
Author: Paul Floyd <pj...@wa...>
Date:   Mon Mar 2 21:27:26 2026 +0100

    Darwin syscall: sigwait arguments are not optionally NULL
    
    So always PRE_MEM_READ/WRITE them.

Diff:
---
 coregrind/m_syswrap/syswrap-darwin.c | 14 +++++---------
 1 file changed, 5 insertions(+), 9 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-darwin.c b/coregrind/m_syswrap/syswrap-darwin.c
index 44357b0afb..1a474bb94f 100644
--- a/coregrind/m_syswrap/syswrap-darwin.c
+++ b/coregrind/m_syswrap/syswrap-darwin.c
@@ -2638,25 +2638,21 @@ POST(__pthread_sigmask)
 
 
 // SYS___sigwait 330
-// int  sigwait(const sigset_t * __restrict, int * __restrict) __DARWIN_ALIAS_C(sigwait);
+// int  __sigwait(const sigset_t * __restrict, int * __restrict) __DARWIN_ALIAS_C(sigwait);
 PRE(__sigwait)
 {
     *flags |= SfMayBlock;
     PRINT("__sigwait ( %#" FMT_REGWORD "x, %#" FMT_REGWORD "x )",
           ARG1,ARG2);
-    PRE_REG_READ2(int, "sigwait",
+    PRE_REG_READ2(int, "__sigwait",
                   const vki_sigset_t *, set, int *, sig);
-    if (ARG1 != 0) {
-        PRE_MEM_READ(  "sigwait(set)",  ARG1, sizeof(vki_sigset_t));
-    }
-    if (ARG2 != 0) {
-        PRE_MEM_WRITE( "sigwait(sig)", ARG2, sizeof(int));
-    }
+    PRE_MEM_READ(  "__sigwait(set)",  ARG1, sizeof(vki_sigset_t));
+    PRE_MEM_WRITE( "__sigwait(sig)", ARG2, sizeof(int));
 }
 
 POST(__sigwait)
 {
-    if (ARG2 != 0) {
+    if (RES == 0) {
         POST_MEM_WRITE( ARG2, sizeof(int));
     }
 }

[Valgrind-developers] [valgrind] FreeBSD syscall: clean up sigwait wrapper

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=5aea26aa5d6c7ed809d98231dd43ef3d7cf23ecf

commit 5aea26aa5d6c7ed809d98231dd43ef3d7cf23ecf
Author: Paul Floyd <pj...@wa...>
Date:   Mon Mar 2 21:12:13 2026 +0100

    FreeBSD syscall: clean up sigwait wrapper
    
    This is another that returns 0 / errno code. The POST was already
    doing the right thing. Changed the PRE to always set SfMayBlock
    rather than only if ARG1 is safe to dereference.
    
    Updated testcase.

Diff:
---
 coregrind/m_syswrap/syswrap-freebsd.c         |  5 +---
 memcheck/tests/freebsd/Makefile.am            |  2 +-
 memcheck/tests/freebsd/sigwait.c              |  9 +++++++
 memcheck/tests/freebsd/sigwait.stderr.exp     | 33 ++++++++++++++++++++----
 memcheck/tests/freebsd/sigwait.stderr.exp-x86 | 36 +++++++++++++++++++++++----
 5 files changed, 70 insertions(+), 15 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index 7dc778595d..04d829ca97 100644
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -4211,11 +4211,8 @@ PRE(sys_sigwait)
    PRE_REG_READ2(int, "sigwait",
                  const vki_sigset_t *, set, int *, sig);
    PRE_MEM_READ(  "sigwait(set)",  ARG1, sizeof(vki_sigset_t));
-   vki_sigset_t* set = (vki_sigset_t*)ARG1;
-   if (ML_(safe_to_deref)(set, sizeof(vki_sigset_t))) {
-      *flags |= SfMayBlock;
-   }
    PRE_MEM_WRITE( "sigwait(sig)", ARG2, sizeof(int));
+   *flags |= SfMayBlock;
 }
 
 // sigwait doesn't follow the norm of returning -1 on error
diff --git a/memcheck/tests/freebsd/Makefile.am b/memcheck/tests/freebsd/Makefile.am
index ae0bd1e48b..9ea49533ff 100644
--- a/memcheck/tests/freebsd/Makefile.am
+++ b/memcheck/tests/freebsd/Makefile.am
@@ -263,7 +263,7 @@ scalar_pdfork_CFLAGS		= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@
 scalar_thr_exit_CFLAGS		= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@
 scalar_vfork_CFLAGS		= ${AM_CFLAGS} @FLAG_W_NO_UNUSED_VARIABLE@
 sctp2_CFLAGS			= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@
-sigwait_CFLAGS			= ${AM_CFLAGS} @FLAG_W_NO_USE_AFTER_FREE@
+sigwait_CFLAGS			= ${AM_CFLAGS} @FLAG_W_NO_USE_AFTER_FREE@ @FLAG_W_NO_NONNULL@
 stat_CFLAGS			= ${AM_CFLAGS} @FLAG_W_NO_MAYBE_UNINITIALIZED@ @FLAG_W_NO_UNINITIALIZED@ @FLAG_W_NO_USE_AFTER_FREE@
 statfs_CFLAGS			= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@ @FLAG_W_NO_USE_AFTER_FREE@ @FLAG_W_NO_ALLOC_SIZE@
 timing_safe_CFLAGS		= ${AM_CFLAGS} @FLAG_W_NO_USE_AFTER_FREE@
diff --git a/memcheck/tests/freebsd/sigwait.c b/memcheck/tests/freebsd/sigwait.c
index 13dd2007e7..eb078c4dfe 100644
--- a/memcheck/tests/freebsd/sigwait.c
+++ b/memcheck/tests/freebsd/sigwait.c
@@ -2,6 +2,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <assert.h>
+#include <errno.h>
 
 // from stack overflow
 // https://stackoverflow.com/questions/6326290/about-the-ambiguous-description-of-sigwait
@@ -63,6 +64,14 @@ int main(void)
 
   result = sigwait(psigset, &sig);
 
+  result = sigwait(NULL, &sig);
+  assert(result == EFAULT);
+
+  raise(SIGUSR1);
+
+  result = sigwait(psigset, NULL);
+  assert(result == EFAULT);
+
   return 0;
 }
 
diff --git a/memcheck/tests/freebsd/sigwait.stderr.exp b/memcheck/tests/freebsd/sigwait.stderr.exp
index 039c432956..925859b950 100644
--- a/memcheck/tests/freebsd/sigwait.stderr.exp
+++ b/memcheck/tests/freebsd/sigwait.stderr.exp
@@ -1,22 +1,45 @@
 Syscall param sigwait(sig) points to unaddressable byte(s)
    at 0x........: _sigwait (in /...libc...)
    by 0x........: __sigwait (in /...libc...)
-   by 0x........: main (sigwait.c:58)
+   by 0x........: main (sigwait.c:59)
  Address 0x........ is 0 bytes inside a block of size 4 free'd
    at 0x........: free (vg_replace_malloc.c:...)
+   by 0x........: main (sigwait.c:58)
+ Block was alloc'd at
+   at 0x........: malloc (vg_replace_malloc.c:...)
    by 0x........: main (sigwait.c:57)
+
+Syscall param sigwait(set) points to unaddressable byte(s)
+   at 0x........: _sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: main (sigwait.c:65)
+ Address 0x........ is 0 bytes inside a block of size 16 free'd
+   at 0x........: free (vg_replace_malloc.c:...)
+   by 0x........: main (sigwait.c:61)
  Block was alloc'd at
    at 0x........: malloc (vg_replace_malloc.c:...)
-   by 0x........: main (sigwait.c:56)
+   by 0x........: main (sigwait.c:28)
+
+Syscall param sigwait(set) points to unaddressable byte(s)
+   at 0x........: _sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: main (sigwait.c:67)
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
 
 Syscall param sigwait(set) points to unaddressable byte(s)
    at 0x........: _sigwait (in /...libc...)
    by 0x........: __sigwait (in /...libc...)
-   by 0x........: main (sigwait.c:64)
+   by 0x........: main (sigwait.c:72)
  Address 0x........ is 0 bytes inside a block of size 16 free'd
    at 0x........: free (vg_replace_malloc.c:...)
-   by 0x........: main (sigwait.c:60)
+   by 0x........: main (sigwait.c:61)
  Block was alloc'd at
    at 0x........: malloc (vg_replace_malloc.c:...)
-   by 0x........: main (sigwait.c:27)
+   by 0x........: main (sigwait.c:28)
+
+Syscall param sigwait(sig) points to unaddressable byte(s)
+   at 0x........: _sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: main (sigwait.c:72)
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
 
diff --git a/memcheck/tests/freebsd/sigwait.stderr.exp-x86 b/memcheck/tests/freebsd/sigwait.stderr.exp-x86
index c03ad32206..f5ed197053 100644
--- a/memcheck/tests/freebsd/sigwait.stderr.exp-x86
+++ b/memcheck/tests/freebsd/sigwait.stderr.exp-x86
@@ -2,23 +2,49 @@ Syscall param sigwait(sig) points to unaddressable byte(s)
    at 0x........: _sigwait (in /...libc...)
    by 0x........: __sigwait (in /...libc...)
    by 0x........: __sigwait (in /...libc...)
-   by 0x........: main (sigwait.c:58)
+   by 0x........: main (sigwait.c:59)
  Address 0x........ is 0 bytes inside a block of size 4 free'd
    at 0x........: free (vg_replace_malloc.c:...)
+   by 0x........: main (sigwait.c:58)
+ Block was alloc'd at
+   at 0x........: malloc (vg_replace_malloc.c:...)
    by 0x........: main (sigwait.c:57)
+
+Syscall param sigwait(set) points to unaddressable byte(s)
+   at 0x........: _sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: main (sigwait.c:65)
+ Address 0x........ is 0 bytes inside a block of size 16 free'd
+   at 0x........: free (vg_replace_malloc.c:...)
+   by 0x........: main (sigwait.c:61)
  Block was alloc'd at
    at 0x........: malloc (vg_replace_malloc.c:...)
-   by 0x........: main (sigwait.c:56)
+   by 0x........: main (sigwait.c:28)
 
 Syscall param sigwait(set) points to unaddressable byte(s)
    at 0x........: _sigwait (in /...libc...)
    by 0x........: __sigwait (in /...libc...)
    by 0x........: __sigwait (in /...libc...)
-   by 0x........: main (sigwait.c:64)
+   by 0x........: main (sigwait.c:67)
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param sigwait(set) points to unaddressable byte(s)
+   at 0x........: _sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: main (sigwait.c:72)
  Address 0x........ is 0 bytes inside a block of size 16 free'd
    at 0x........: free (vg_replace_malloc.c:...)
-   by 0x........: main (sigwait.c:60)
+   by 0x........: main (sigwait.c:61)
  Block was alloc'd at
    at 0x........: malloc (vg_replace_malloc.c:...)
-   by 0x........: main (sigwait.c:27)
+   by 0x........: main (sigwait.c:28)
+
+Syscall param sigwait(sig) points to unaddressable byte(s)
+   at 0x........: _sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: __sigwait (in /...libc...)
+   by 0x........: main (sigwait.c:72)
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd

[Valgrind-developers] [valgrind] Bug 516748 - clock_nanosleep was also wrong

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=7012c31a609e342be2d9ece38eda55a0cdddf20e

commit 7012c31a609e342be2d9ece38eda55a0cdddf20e
Author: Paul Floyd <pj...@wa...>
Date:   Mon Mar 2 20:15:32 2026 +0100

    Bug 516748 - clock_nanosleep was also wrong
    
    clock_nanosleep returns 0 or an errno error code, not 0/-1 and it does not set errno.
    
    The code was copied and pasted from Linux which does return 0/-1.
    That means that the POST only needs a POST_MEM_WRITE for ARG4 if
    the remainder timespec pointer is not NULL and RES is EINTR.
    The error flag is not set so the syscall appears to have succeeded.

Diff:
---
 .gitignore                                         |  3 +-
 coregrind/m_syswrap/syswrap-freebsd.c              |  2 +-
 memcheck/tests/freebsd/Makefile.am                 |  9 ++--
 memcheck/tests/freebsd/clock_nanosleep1.c          | 43 +++++++++++++++++++
 memcheck/tests/freebsd/clock_nanosleep1.stderr.exp | 12 ++++++
 memcheck/tests/freebsd/clock_nanosleep1.vgtest     |  2 +
 memcheck/tests/freebsd/clock_nanosleep2.c          | 48 ++++++++++++++++++++++
 memcheck/tests/freebsd/clock_nanosleep2.vgtest     |  2 +
 memcheck/tests/freebsd/clock_nanosleep_interrupt.c | 32 ---------------
 .../freebsd/clock_nanosleep_interrupt.stderr.exp   |  7 ----
 .../tests/freebsd/clock_nanosleep_interrupt.vgtest |  2 -
 11 files changed, 115 insertions(+), 47 deletions(-)

diff --git a/.gitignore b/.gitignore
index 42581df318..8f9ba9ece7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1440,7 +1440,8 @@
 /memcheck/tests/freebsd/capsicum
 /memcheck/tests/freebsd/chflags
 /memcheck/tests/freebsd/chmod_chown
-/memcheck/tests/freebsd/clock_nanosleep_interrupt
+/memcheck/tests/freebsd/clock_nanosleep1
+/memcheck/tests/freebsd/clock_nanosleep2
 /memcheck/tests/freebsd/delete_sized_mismatch
 /memcheck/tests/freebsd/errno_aligned_allocs
 /memcheck/tests/freebsd/eventfd1
diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index c9a3939478..7dc778595d 100644
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -2613,7 +2613,7 @@ PRE(sys_clock_nanosleep)
 
 POST(sys_clock_nanosleep)
 {
-   if (ARG4 != 0 && FAILURE && ERR == VKI_EINTR) {
+   if (ARG4 != 0 && RES == VKI_EINTR) {
       POST_MEM_WRITE( ARG4, sizeof(struct vki_timespec) );
    }
 }
diff --git a/memcheck/tests/freebsd/Makefile.am b/memcheck/tests/freebsd/Makefile.am
index c59a02b798..ae0bd1e48b 100644
--- a/memcheck/tests/freebsd/Makefile.am
+++ b/memcheck/tests/freebsd/Makefile.am
@@ -35,8 +35,9 @@ EXTRA_DIST = \
 		chflags.stderr.exp-x86 \
 	chmod_chown.vgtest \
 	chmod_chown.stderr.exp \
-	clock_nanosleep_interrupt.vgtest \
-	clock_nanosleep_interrupt.stderr.exp \
+	clock_nanosleep1.vgtest \
+	clock_nanosleep1.stderr.exp \
+	clock_nanosleep2.vgtest \
 	delete_sized_mismatch.vgtest \
 	delete_sized_mismatch.stderr.exp \
 	delete_sized_mismatch_xml.vgtest \
@@ -150,7 +151,7 @@ check_PROGRAMS = \
 	access aio aio_read aligned_alloc bug464476 bug470713 \
 	bug483786 \
 	capsicum chflags \
-	chmod_chown clock_nanosleep_interrupt \
+	chmod_chown clock_nanosleep1 clock_nanosleep2 \
 	delete_sized_mismatch errno_aligned_allocs \
 	extattr fbsd278566 \
 	fexecve \
@@ -233,7 +234,7 @@ endif
 access_CFLAGS 			= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@ @FLAG_W_NO_USE_AFTER_FREE@
 aligned_alloc_CFLAGS 		= ${AM_CFLAGS} @FLAG_W_NO_NON_POWER_OF_TWO_ALIGNMENT@
 capsicum_CFLAGS 		= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@ @FLAG_W_NO_USE_AFTER_FREE@
-clock_nanosleep_interrupt_CFLAGS = ${AM_CFLAGS} @FLAG_W_NO_ALLOC_SIZE@
+clock_nanosleep1_CFLAGS		= ${AM_CFLAGS} @FLAG_W_NO_ALLOC_SIZE@
 chflags_CFLAGS 			= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@ @FLAG_W_NO_USE_AFTER_FREE@
 chmod_chown_CFLAGS 		= ${AM_CFLAGS} @FLAG_W_NO_UNINITIALIZED@ @FLAG_W_NO_USE_AFTER_FREE@
 delete_sized_mismatch_CXXFLAGS	= ${AM_CXXFLAGS} --std=c++14
diff --git a/memcheck/tests/freebsd/clock_nanosleep1.c b/memcheck/tests/freebsd/clock_nanosleep1.c
new file mode 100644
index 0000000000..14d13fa1d5
--- /dev/null
+++ b/memcheck/tests/freebsd/clock_nanosleep1.c
@@ -0,0 +1,43 @@
+#include <fcntl.h>
+#include <signal.h>
+#include <sys/time.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <errno.h>
+
+volatile int     ticks = 0;
+struct itimerval timert;
+struct sigaction timer_action;
+
+void handle_alrm(int sig) { ticks++; }
+
+int main(int argc, char* argv[])
+{
+   timer_action.sa_handler = handle_alrm;
+   sigemptyset(&timer_action.sa_mask);
+   timer_action.sa_flags = SA_RESTART;
+
+   sigaction(SIGALRM, &timer_action, NULL);
+
+   timert.it_interval.tv_sec = timert.it_value.tv_sec = 0;
+   timert.it_interval.tv_usec = timert.it_value.tv_usec = 100;
+   setitimer(ITIMER_REAL, &timert, NULL);
+   
+   struct timespec ts_initialized = {0, 1000000};
+   int ret;
+
+   ret = clock_nanosleep(CLOCK_MONOTONIC, 0, &ts_initialized,
+                         NULL);
+   assert(ret == EINTR);
+
+   struct timespec* too_small = malloc(1);
+
+   ret = clock_nanosleep(CLOCK_MONOTONIC, 0, &ts_initialized,
+                         too_small);
+   assert(ret == EINTR);
+
+   ret = clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, NULL,
+                         &ts_initialized);
+   assert(ret == EFAULT);
+}
diff --git a/memcheck/tests/freebsd/clock_nanosleep1.stderr.exp b/memcheck/tests/freebsd/clock_nanosleep1.stderr.exp
new file mode 100644
index 0000000000..bd5566ef9f
--- /dev/null
+++ b/memcheck/tests/freebsd/clock_nanosleep1.stderr.exp
@@ -0,0 +1,12 @@
+Syscall param clock_nanosleep(rmtp) points to unaddressable byte(s)
+   ...
+   by 0x........: main (clock_nanosleep1.c:36)
+ Address 0x........ is 0 bytes after a block of size 1 alloc'd
+   at 0x........: malloc (vg_replace_malloc.c:...)
+   by 0x........: main (clock_nanosleep1.c:34)
+
+Syscall param clock_nanosleep(rqtp) points to unaddressable byte(s)
+   ...
+   by 0x........: main (clock_nanosleep1.c:40)
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
diff --git a/memcheck/tests/freebsd/clock_nanosleep1.vgtest b/memcheck/tests/freebsd/clock_nanosleep1.vgtest
new file mode 100644
index 0000000000..3d514bff7d
--- /dev/null
+++ b/memcheck/tests/freebsd/clock_nanosleep1.vgtest
@@ -0,0 +1,2 @@
+prog: clock_nanosleep1
+vgopts: -q
diff --git a/memcheck/tests/freebsd/clock_nanosleep2.c b/memcheck/tests/freebsd/clock_nanosleep2.c
new file mode 100644
index 0000000000..ab22894f6b
--- /dev/null
+++ b/memcheck/tests/freebsd/clock_nanosleep2.c
@@ -0,0 +1,48 @@
+#include <time.h>
+#include <signal.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <unistd.h>
+
+static void handler(int sig) { (void)sig; }
+
+int main(void)
+{
+    struct sigaction sa;
+    memset(&sa, 0, sizeof(sa));
+    sa.sa_handler = handler;
+    sigaction(SIGUSR1, &sa, NULL);   /* no SA_RESTART */
+
+    /* Child will interrupt us */
+    if (fork() == 0) {
+        usleep(100000);  /* 100ms */
+        kill(getppid(), SIGUSR1);
+        _exit(0);
+    }
+
+    struct timespec req = { .tv_sec = 2, .tv_nsec = 0 };
+    struct timespec rem;
+
+    int ret = clock_nanosleep(CLOCK_MONOTONIC, 0, &req, &rem);
+
+    if (ret != EINTR)
+    {
+        printf("Unexpected return: %d\n", ret);
+        return 1;
+    }
+
+    /* Force full struct read */
+    volatile long sec  = rem.tv_sec;
+    volatile long nsec = rem.tv_nsec;
+
+    /* Trigger uninit read error if rem was not marked as initialised */
+    if (sec || nsec)
+    {
+        return 1;
+    }
+
+    return 0;
+}
+
diff --git a/memcheck/tests/freebsd/clock_nanosleep2.vgtest b/memcheck/tests/freebsd/clock_nanosleep2.vgtest
new file mode 100644
index 0000000000..c848fa34e1
--- /dev/null
+++ b/memcheck/tests/freebsd/clock_nanosleep2.vgtest
@@ -0,0 +1,2 @@
+prog: clock_nanosleep2
+vgopts: -q
diff --git a/memcheck/tests/freebsd/clock_nanosleep_interrupt.c b/memcheck/tests/freebsd/clock_nanosleep_interrupt.c
deleted file mode 100644
index 49f4a2814b..0000000000
--- a/memcheck/tests/freebsd/clock_nanosleep_interrupt.c
+++ /dev/null
@@ -1,32 +0,0 @@
-#include <fcntl.h>
-#include <signal.h>
-#include <stdio.h>
-#include <sys/time.h>
-#include <unistd.h>
-#include <stdlib.h>
-
-volatile int     ticks = 0;
-struct itimerval timert;
-struct sigaction timer_action;
-
-void handle_vtalrm(int sig) { ticks++; }
-
-
-int main(int argc, char* argv[])
-{
-   timer_action.sa_handler = handle_vtalrm;
-   sigemptyset(&timer_action.sa_mask);
-   timer_action.sa_flags = SA_RESTART;
-
-   sigaction(SIGVTALRM, &timer_action, NULL);
-
-   timert.it_interval.tv_sec = timert.it_value.tv_sec = 0;
-   timert.it_interval.tv_usec = timert.it_value.tv_usec = 500;
-   setitimer(ITIMER_VIRTUAL, &timert, NULL);
-   
-   struct timespec ts_initialized = {0, 1000000};
-   struct timespec* too_small = malloc(1);
-
-   clock_nanosleep(CLOCK_MONOTONIC, TIMER_ABSTIME, &ts_initialized,
-                   too_small);
-}
diff --git a/memcheck/tests/freebsd/clock_nanosleep_interrupt.stderr.exp b/memcheck/tests/freebsd/clock_nanosleep_interrupt.stderr.exp
deleted file mode 100644
index 1152ed2f10..0000000000
--- a/memcheck/tests/freebsd/clock_nanosleep_interrupt.stderr.exp
+++ /dev/null
@@ -1,7 +0,0 @@
-Syscall param clock_nanosleep(rmtp) points to unaddressable byte(s)
-   ...
-   by 0x........: main (clock_nanosleep_interrupt.c:30)
- Address 0x........ is 0 bytes after a block of size 1 alloc'd
-   at 0x........: malloc (vg_replace_malloc.c:...)
-   by 0x........: main (clock_nanosleep_interrupt.c:28)
-
diff --git a/memcheck/tests/freebsd/clock_nanosleep_interrupt.vgtest b/memcheck/tests/freebsd/clock_nanosleep_interrupt.vgtest
deleted file mode 100644
index c4b785d054..0000000000
--- a/memcheck/tests/freebsd/clock_nanosleep_interrupt.vgtest
+++ /dev/null
@@ -1,2 +0,0 @@
-prog: clock_nanosleep_interrupt
-vgopts: -q

Re: [Valgrind-developers] GCC message noise

[Florian K. <fl...@ei...>]

Hi Paul,

On 3/1/26 11:44, Paul Floyd via Valgrind-developers wrote:
> 
> I don't have any strong opinions. I mainly use C++ at work so I'm used to 
> monster template warnings/errors.
> 
> First though, why the warning? 

Because we compile with -Wall which implies -Wuninitialized which complains when 
you pass a pointer as an argument to an unknown function which declares the 
corresponding parameter to be a pointer to const. Like so:

void bar(const void *);

void foo(void)
{
   int o;
   bar(&o);
}

Which is exactly what happens here.

   Florian

[Valgrind-developers] [valgrind] FreeBSD README: add a section on syscalls.

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=8f91162f606e3c75a1eda20bd11fc7276ee4b913

commit 8f91162f606e3c75a1eda20bd11fc7276ee4b913
Author: Paul Floyd <pj...@wa...>
Date:   Sun Mar 1 21:51:29 2026 +0100

    FreeBSD README: add a section on syscalls.
    
    With an emphasis on syscall SYS_syscall argument shuffling.

Diff:
---
 README.freebsd | 70 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)

diff --git a/README.freebsd b/README.freebsd
index ef850513ee..dcb950194c 100644
--- a/README.freebsd
+++ b/README.freebsd
@@ -186,6 +186,76 @@ git history. You can also look at
 
 https://docs.freebsd.org/en/books/porters-handbook/versions/
 
+More about syscalls
+-------------------
+
+One thing that is specific to FreeBSD (and Darwin) is how the "syscall()"
+libc function is implemented. On Linux this function shuffles the arguments
+so that "syscall(__NR_write, 1, data, len)" will result in syscall
+__NR_write (4) with arguments 1, data, len. On FreeBSD (and Darwin) this
+shuffling is not done in libc, it is done in the kernel. FreeBSD has two
+special "syscall syscalls". These are syscalls 0 and 198, which take
+the target syscall number and its arguments as parameters.
+"syscall(SYS_write, 1, data, len)" on FreeBSD will result in
+syscall SYS_syscall (0) with arguments 4 (SYS_write), 1, data, len. The
+kernel will then call kern_write with arguments 1, data, len.
+
+The way that syscall arguments are passed on FreeBSD depends on the
+architecture. On x86 they are all on the stack. On arm64 they are
+all in registers. On amd64 the syscall number and the first six arguments
+are in registers and any further arguments are on the stack.
+
+There are two ways that Valgrind makes syscalls.
+a) for its own use as the host
+b) on behalf of the guest.
+
+The first category are fairly straightforward. These are called via a
+series of macros from VG_(do_syscall0) to VG_(do_syscall8). The number
+indicates the argument count. The macros expand to VG_(do_syscall) which
+uses do_syscall_WRK to do the job in assembler.
+
+The second category can be much more complicated. It is all done in
+VG_(client_syscall). There are extensive explanations in the same file,
+syswrap-main.c. The main things that this function does are
+
+i.    Get the syscall arguments with getSyscallArgsFromGuestState. This function
+      has special handling for "syscall syscall". Since we want to validate
+      the arguments of the final syscall getSyscallArgsFromGuestState will shuffle
+      the arguments to be in the order of the final syscall (canonical order).
+      In order to be able to distinguish between "syscall syscall" and other syscalls
+      two syscall numbers may be stored, original_sysno and canonical_sysno.
+      Usually they are the same, only differing for "syscall syscall".
+ii.   Call getSyscallArgLayout. This is always in canonical form. The layout
+      indicates whether arguments are in registers or on the stack. On FreeBSD
+      with "syscall syscall" the arguments are effectively bumped up one slot.
+      That means that there is special handling for argument 6 on amd64,
+      which can either be in a register or on the stack depending on whether
+      it is a regular syscall or "syscall syscall".
+iii.  Call a pre-syscall tool hook (mainly used for syscall timing by callgrind
+      and cachegrind). This uses the args from step i.
+iv.   Call the PRE handler. That uses the arguments fetched in step i and the layout
+      obtained in step ii. The PRE_REG_READX macros use the layout and
+      the PRE_MEM_READ/WRITE and ARGX macros use the canonical arguments.
+
+Several things are possible at this point. The PRE may have performed the
+syscall or marked it as complete. The syscall may be marked as blocking.
+If the syscall is not blocking then Valgrind just makes the syscall and stores
+the result. Blocking system calls are more complicated and continue as follows.
+
+v.    Put back the syscall arguments with putSyscallArgsIntoGuestState()
+      (they may have changed in the PRE). On FreeBSD the original_sysno is checked
+      to see which form of unshuffling needs to be done.
+vi.   Call the syscall via ML_(do_syscall_for_client_WRK). This is preceded
+      by releasing the global lock and restoring the client signal mask, and
+      followed by blocking signals and acquiring the global lock. 
+vii.  Get the syscall arguments again with getSyscallArgsFromGuestState.
+      This is only required to match the non-blocking flow.
+
+The final two steps are for both blocking and non-blocking system calls.
+
+viii. Put the syscall result into the guest state.
+ix.   Call the post handler.
+
 Capsicum enabled applications
 -----------------------------
 Valgrind will not work well with Capsicum enabled applications. As an example,

[Valgrind-developers] [valgrind] FreeBSD regtest: add lsframe1 and lsframe2

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=b84a262714bba52431a5165320b3f002805ccb22

commit b84a262714bba52431a5165320b3f002805ccb22
Author: Paul Floyd <pj...@wa...>
Date:   Sun Mar 1 19:55:56 2026 +0100

    FreeBSD regtest: add lsframe1 and lsframe2
    
    Not only Darwin does not have a version of these tests.
    
    I've been trying to see why lsframe2 is failing on illumos and I saw that
    these tests are only for Linux and Solaris. So this adds FreeBSD to
    the mix.

Diff:
---
 .gitignore                                 |  2 ++
 memcheck/tests/freebsd/Makefile.am         |  4 +++-
 memcheck/tests/freebsd/lsframe1.c          |  1 +
 memcheck/tests/freebsd/lsframe1.stderr.exp | 12 ++++++++++++
 memcheck/tests/freebsd/lsframe1.vgtest     |  3 +++
 memcheck/tests/freebsd/lsframe2.c          |  1 +
 memcheck/tests/freebsd/lsframe2.stderr.exp | 12 ++++++++++++
 memcheck/tests/freebsd/lsframe2.vgtest     |  3 +++
 8 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index c544d77d74..42581df318 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1462,6 +1462,8 @@
 /memcheck/tests/freebsd/kqueue
 /memcheck/tests/freebsd/kqueuex
 /memcheck/tests/freebsd/linkat
+/memcheck/tests/freebsd/lsframe1
+/memcheck/tests/freebsd/lsframe2
 /memcheck/tests/freebsd/memalign
 /memcheck/tests/freebsd/misc
 /memcheck/tests/freebsd/openpty
diff --git a/memcheck/tests/freebsd/Makefile.am b/memcheck/tests/freebsd/Makefile.am
index 9b67fb299a..c59a02b798 100644
--- a/memcheck/tests/freebsd/Makefile.am
+++ b/memcheck/tests/freebsd/Makefile.am
@@ -79,6 +79,8 @@ EXTRA_DIST = \
 	leak-autofreepool-7.stderr.exp \
 	linkat.vgtest \
 	linkat.stderr.exp \
+	lsframe1.vgtest lsframe1.stderr.exp \
+	lsframe2.vgtest lsframe2.stderr.exp \
         memalign.vgtest memalign.stderr.exp \
 	memalign_supp.vgtest memalign_supp.stderr.exp \
 	memalign_supp.supp \
@@ -155,7 +157,7 @@ check_PROGRAMS = \
 	file_locking_wait6 \
 	get_set_context get_set_login getfh \
 	kenv \
-	kqueue linkat memalign misc \
+	kqueue linkat lsframe1 lsframe2 memalign misc \
 	openpty \
 	pdfork_pdkill getfsstat inlinfo inlinfo_nested.so \
 	revoke scalar \
diff --git a/memcheck/tests/freebsd/lsframe1.c b/memcheck/tests/freebsd/lsframe1.c
new file mode 120000
index 0000000000..847c404275
--- /dev/null
+++ b/memcheck/tests/freebsd/lsframe1.c
@@ -0,0 +1 @@
+../linux/lsframe1.c
\ No newline at end of file
diff --git a/memcheck/tests/freebsd/lsframe1.stderr.exp b/memcheck/tests/freebsd/lsframe1.stderr.exp
new file mode 100644
index 0000000000..e196589999
--- /dev/null
+++ b/memcheck/tests/freebsd/lsframe1.stderr.exp
@@ -0,0 +1,12 @@
+
+lsframe1: start
+lsframe1: done, result is -8388608
+
+HEAP SUMMARY:
+    in use at exit: ... bytes in ... blocks
+  total heap usage: ... allocs, ... frees, ... bytes allocated
+
+For a detailed leak analysis, rerun with: --leak-check=full
+
+For lists of detected and suppressed errors, rerun with: -s
+ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
diff --git a/memcheck/tests/freebsd/lsframe1.vgtest b/memcheck/tests/freebsd/lsframe1.vgtest
new file mode 100644
index 0000000000..01c84f1187
--- /dev/null
+++ b/memcheck/tests/freebsd/lsframe1.vgtest
@@ -0,0 +1,3 @@
+prog: lsframe1
+vgopts: --main-stacksize=67200000 --max-stackframe=67200000
+stderr_filter: ../filter_allocs
diff --git a/memcheck/tests/freebsd/lsframe2.c b/memcheck/tests/freebsd/lsframe2.c
new file mode 120000
index 0000000000..273932087a
--- /dev/null
+++ b/memcheck/tests/freebsd/lsframe2.c
@@ -0,0 +1 @@
+../linux/lsframe2.c
\ No newline at end of file
diff --git a/memcheck/tests/freebsd/lsframe2.stderr.exp b/memcheck/tests/freebsd/lsframe2.stderr.exp
new file mode 100644
index 0000000000..adf1ce4b6d
--- /dev/null
+++ b/memcheck/tests/freebsd/lsframe2.stderr.exp
@@ -0,0 +1,12 @@
+
+lsframe2: start
+lsframe2: done, result is -272629760
+
+HEAP SUMMARY:
+    in use at exit: ... bytes in ... blocks
+  total heap usage: ... allocs, ... frees, ... bytes allocated
+
+For a detailed leak analysis, rerun with: --leak-check=full
+
+For lists of detected and suppressed errors, rerun with: -s
+ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
diff --git a/memcheck/tests/freebsd/lsframe2.vgtest b/memcheck/tests/freebsd/lsframe2.vgtest
new file mode 100644
index 0000000000..a821f5d2f8
--- /dev/null
+++ b/memcheck/tests/freebsd/lsframe2.vgtest
@@ -0,0 +1,3 @@
+prog: lsframe2
+vgopts: --main-stacksize=68500000
+stderr_filter: ../filter_allocs

[Valgrind-developers] [valgrind] Explain why realloc_size_zero does not use Addr.Block and clean up a volatile cast

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=b6903333fea9e3fdce97e6508bcf59a448b9ef52

commit b6903333fea9e3fdce97e6508bcf59a448b9ef52
Author: Paul Floyd <pj...@wa...>
Date:   Sun Mar 1 18:19:46 2026 +0100

    Explain why realloc_size_zero does not use Addr.Block and clean up a volatile cast

Diff:
---
 coregrind/m_syswrap/syswrap-freebsd.c | 10 +---------
 memcheck/mc_errors.c                  |  9 +++++++++
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index c2e2f50dc9..c9a3939478 100644
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -7026,15 +7026,7 @@ PRE(sys_aio_readv)
          SET_STATUS_Failure( VKI_EBADF );
       } else {
          SizeT vec_count = (SizeT)iocb->aio_nbytes;
-#if defined(__clang__)
-#pragma clang diagnostic push
-         // yes, I know it is volatile
-#pragma clang diagnostic ignored "-Wcast-qual"
-#endif
-         struct vki_iovec* p_iovec  = (struct vki_iovec*)iocb->aio_buf;
-#if defined(__clang__)
-#pragma clang diagnostic pop
-#endif
+         struct vki_iovec* p_iovec  = (struct vki_iovec*)(uintptr_t)iocb->aio_buf;
          PRE_MEM_READ("aio_readv(iocb->aio_iov)", (Addr)p_iovec,  vec_count*sizeof(struct vki_iovec));
          if (ML_(safe_to_deref)(p_iovec, vec_count*sizeof(struct vki_iovec))) {
             for (SizeT i = 0U; i < vec_count; ++i) {
diff --git a/memcheck/mc_errors.c b/memcheck/mc_errors.c
index e9a8f3f02e..b8869733fd 100644
--- a/memcheck/mc_errors.c
+++ b/memcheck/mc_errors.c
@@ -1014,6 +1014,15 @@ void MC_(record_realloc_size_zero) ( ThreadId tid, Addr a )
 {
    MC_Error extra;
    tl_assert(VG_INVALID_THREADID != tid);
+   /*
+    * We can't fill the Block as in freemismatch above.
+    * That's because if realloc size zero frees we literally do that
+    * and transform the call into a free before bothering to get the
+    * old MC_Chunk.
+    *
+    * See VG_(maybe_record_error) for a description of how this gets
+    * filled on demand.
+    */
    extra.Err.ReallocSizeZero.ai.tag = Addr_Undescribed;
    VG_(maybe_record_error)( tid, Err_ReallocSizeZero, a, /*s*/NULL, &extra );
 }

Re: [Valgrind-developers] GCC message noise

[Paul F. <pj...@wa...>]

On 2026-03-01 00:07, Florian Krohm wrote:
>
> I was thinking of adding those 2 GCC options to Makefile.all.am.
> clang does not seem to support those which can be arranged for.
> How do you feel about that?
>
>
Hi Florian

I don't have any strong opinions. I mainly use C++ at work so I'm used 
to monster template warnings/errors.

First though, why the warning? I imagine that I had a similar warning on 
FreeBSD some time in the past (but not with GCC 14.2) because I added a 
call to  VG_(sigemptyset)(). That's probably unnecessary, "saved" is 
just the scratch memory for ML_(do_syscall_for_client_WRK) to save and 
restore the client signal masks with sigprocmask (I assume that is the 
same on all platforms). Maybe GCC can't see what happens 
in ML_(do_syscall_for_client_WRK) and assumes the worst?

The other thing that this leads to is the use of macros. We have a lot 
of decorative macros for our 'namespace' system. It wouldn't be easy to 
change that. We also have a good number of functional macros. We could 
replace those with static inline functions. That would improve 
warning/error messages a bit and also make debugging a bit easier 
(though for  real ease of debugging a -g only build is still required).

A+

Paul

[Valgrind-developers] GCC message noise

[Florian K. <fl...@ei...>]

Today in syswrap-main.c:

In file included from ./pub_core_basics.h:38,
                  from m_syswrap/syswrap-main.c:31:
m_syswrap/syswrap-main.c: In function ‘do_syscall_for_client’:
../include/pub_tool_basics.h:69:30: warning: ‘saved’ may be used uninitialized 
[-Wmaybe-uninitialized]
    69 | #define ML_(str)    VGAPPEND(vgModuleLocal_,    str)
../include/pub_tool_basics.h:66:29: note: in definition of macro ‘VGAPPEND’
    66 | #define VGAPPEND(str1,str2) str1##str2
       |                             ^~~~
m_syswrap/syswrap-main.c:357:10: note: in expansion of macro ‘ML_’
   357 |    err = ML_(do_syscall_for_client_WRK)(
       |          ^~~
../include/pub_tool_basics.h:69:30: note: by argument 4 of type ‘const 
vki_sigset_t *’ to ‘vgModuleLocal_do_syscall_for_client_WRK’ declared here
    69 | #define ML_(str)    VGAPPEND(vgModuleLocal_,    str)
       |                              ^~~~~~~~~~~~~~
../include/pub_tool_basics.h:66:29: note: in definition of macro ‘VGAPPEND’
    66 | #define VGAPPEND(str1,str2) str1##str2
       |                             ^~~~
m_syswrap/syswrap-main.c:299:7: note: in expansion of macro ‘ML_’
   299 | UWord ML_(do_syscall_for_client_WRK)( Word syscallno,
       |       ^~~
m_syswrap/syswrap-main.c:354:17: note: ‘saved’ declared here
   354 |    vki_sigset_t saved;


Am I the only one who finds this annnoying? 22 lines for a single warning?
There does not seem to be something like -w for "note:" things.
What helps is this:
-fno-diagnostics-show-caret  to get rid of ^~~~~~ stuff
-ftrack-macro-expansion=0

That reduces the output here to 4 lines:

m_syswrap/syswrap-main.c: In function ‘do_syscall_for_client’:
m_syswrap/syswrap-main.c:357:10: warning: ‘saved’ may be used uninitialized 
[-Wmaybe-uninitialized]
m_syswrap/syswrap-main.c:299:7: note: by argument 4 of type ‘const vki_sigset_t 
*’ to ‘vgModuleLocal_do_syscall_for_client_WRK’ declared here
m_syswrap/syswrap-main.c:354:17: note: ‘saved’ declared here

Which looks less like transmission line noise.

I was thinking of adding those 2 GCC options to Makefile.all.am.
clang does not seem to support those which can be arranged for.
How do you feel about that?

    Florian

[Valgrind-developers] [valgrind] Darwin syscall: clean up posix_spawn and add to scalar

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=ab1cf750c53cc1ec2ecb3d885764caa81b8fdd14

commit ab1cf750c53cc1ec2ecb3d885764caa81b8fdd14
Author: Paul Floyd <pj...@wa...>
Date:   Sat Feb 28 16:43:38 2026 +0100

    Darwin syscall: clean up posix_spawn and add to scalar

Diff:
---
 coregrind/m_syswrap/syswrap-darwin.c    |  4 +++-
 memcheck/tests/darwin/scalar.c          |  6 ++++-
 memcheck/tests/darwin/scalar.stderr.exp | 39 ++++++++++++++++++++++++++++++++-
 3 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-darwin.c b/coregrind/m_syswrap/syswrap-darwin.c
index ff0eaa27b0..44357b0afb 100644
--- a/coregrind/m_syswrap/syswrap-darwin.c
+++ b/coregrind/m_syswrap/syswrap-darwin.c
@@ -3801,6 +3801,8 @@ static void pre_argv_envp(Addr a, ThreadId tid, const HChar* s1, const HChar* s2
       Addr a_deref;
       Addr* a_p = (Addr*)a;
       PRE_MEM_READ( s1, (Addr)a_p, sizeof(Addr) );
+      if (!ML_(safe_to_deref)(a_p, sizeof(char*)))
+         return;
       a_deref = *a_p;
       if (0 == a_deref)
          break;
@@ -4009,7 +4011,7 @@ PRE(posix_spawn)
    // are omitted.
    //
    if (!trace_this_child) {
-      argv = (HChar**)ARG6;
+      argv = (HChar**)ARG5;
    } else {
       vg_assert( VG_(args_for_valgrind) );
       vg_assert( VG_(args_for_valgrind_noexecpass) >= 0 );
diff --git a/memcheck/tests/darwin/scalar.c b/memcheck/tests/darwin/scalar.c
index dd53145d2c..c4e93814ba 100644
--- a/memcheck/tests/darwin/scalar.c
+++ b/memcheck/tests/darwin/scalar.c
@@ -421,7 +421,11 @@ int main(void)
    // __NR_flistxattr 241
    // __NR_fsctl 242
    // __NR_initgroups 243
-   // __NR_posix_spawn 244
+
+   // two of the pointers, file_actions and attr, are opaque void* pointers
+   // currently we do not check what they point to, so "4m" for the moment
+   GO(__NR_posix_spawn, 244, "6s 4m");
+   SY(__NR_posix_spawn, x0+1, x0+1, x0+1, x0+1, x0+1, x0+1);
 
    GO_UNIMP(245-246, "unused");
 
diff --git a/memcheck/tests/darwin/scalar.stderr.exp b/memcheck/tests/darwin/scalar.stderr.exp
index b0fd9e4a34..da616dcb79 100644
--- a/memcheck/tests/darwin/scalar.stderr.exp
+++ b/memcheck/tests/darwin/scalar.stderr.exp
@@ -544,6 +544,43 @@ Syscall param exchangedata(path2) points to unaddressable byte(s)
 -----------------------------------------------------
 (228-229):       unused
 -----------------------------------------------------
+-----------------------------------------------------
+x20000f4(244):    __NR_posix_spawn 6s 4m
+-----------------------------------------------------
+Syscall param posix_spawn(pid) contains uninitialised byte(s)
+   ...
+
+Syscall param posix_spawn(path) contains uninitialised byte(s)
+   ...
+
+Syscall param posix_spawn(file_actions) contains uninitialised byte(s)
+   ...
+
+Syscall param posix_spawn(attrp) contains uninitialised byte(s)
+   ...
+
+Syscall param posix_spawn(argv) contains uninitialised byte(s)
+   ...
+
+Syscall param posix_spawn(envp) contains uninitialised byte(s)
+   ...
+
+Syscall param posix_spawn(pid) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param posix_spawn(path) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param posix_spawn(argv) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param posix_spawn(envp) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
 -----------------------------------------------------
 (245-246):       unused
 -----------------------------------------------------
@@ -584,6 +621,7 @@ Syscall param shmctl(IPC_STAT, buf) points to unaddressable byte(s)
 -----------------------------------------------------
 x2000108(264):          __NR_shmdt 1s 0m
 -----------------------------------------------------
+
 Syscall param shmdt(shmaddr) contains uninitialised byte(s)
    ...
 
@@ -630,7 +668,6 @@ Syscall param sem_close(sem) contains uninitialised byte(s)
 -----------------------------------------------------
 x200010e(270):     __NR_sem_unlink 1s 1m
 -----------------------------------------------------
-
 Syscall param sem_unlink(name) contains uninitialised byte(s)
    ...

[Valgrind-developers] [valgrind] Darwin syscall: add missing attr argument to posix_spawn wrapper

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=5ed07837279960ff8149f03e7e12d446219d283d

commit 5ed07837279960ff8149f03e7e12d446219d283d
Author: Paul Floyd <pj...@wa...>
Date:   Sat Feb 28 14:48:14 2026 +0100

    Darwin syscall: add missing attr argument to posix_spawn wrapper

Diff:
---
 coregrind/m_syswrap/syswrap-darwin.c | 81 ++++++++++++++++++++++++++----------
 include/vki/vki-darwin.h             |  5 +++
 2 files changed, 65 insertions(+), 21 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-darwin.c b/coregrind/m_syswrap/syswrap-darwin.c
index 2687b3b4c5..ff0eaa27b0 100644
--- a/coregrind/m_syswrap/syswrap-darwin.c
+++ b/coregrind/m_syswrap/syswrap-darwin.c
@@ -3834,6 +3834,40 @@ static SysRes simple_pre_exec_check ( const HChar* exe_name,
    }
    return VG_(mk_SysRes_Success)(0);
 }
+
+/*
+ * FIXME PJF
+ * From the man page
+ *
+ * "The argument file_actions is either NULL, or it is a pointer to a file actions object that
+ * was initialized by a call to posix_spawn_file_actions_init(3) and represents zero or more
+ * file actions.
+ *
+ * File descriptors open in the calling process image remain open in the new process image,
+ * except for those for which the close-on-exec flag is set (see close(2) and fcntl(2)).
+ * Descriptors that remain open are unaffected by posix_spawn() unless their behaviour is
+ * modified by particular spawn flags or a file action; see posix_spawnattr_setflags(3) and
+ * posix_spawn_file_actions_init(3) for additional information."
+ *
+ * If file_arguments is non-NULL and --trace-children=yes is specified then we chould call
+ *  VG_(unimplemented)().
+ *
+ * file_actions and attrp are both pointers to types that are typedef'd to void*
+ * in userland headers. That means they are black bloxed in userland and only the
+ * kernel knows the type. We'll need to copy the type into Valgrind if we want to
+ * peek at what these arguments point to.
+ *
+ * To properly implement posix_spawn we would need a mechanism for a traced
+ * child process to "inherit" a list of opened files. I guess that would
+ * involve some way of passing info about filenanme, fd, open mode, offset,
+ * attributes to so that the child could open them before the child code runs.
+ */
+
+// __NR_posix_spawn    VG_DARWIN_SYSCALL_CONSTRUCT_UNIX(244)
+// int posix_spawn(pid_t *restrict pid, const char *restrict path,
+//                 const posix_spawn_file_actions_t *file_actions,
+//                 const posix_spawnattr_t *restrict attrp, char *const argv[restrict],
+//                 char *const envp[restrict]);
 PRE(posix_spawn)
 {
    HChar*       path = NULL;       /* path to executable */
@@ -3846,33 +3880,37 @@ PRE(posix_spawn)
    Bool         trace_this_child;
 
    /* args: pid_t* pid
-            char*  path
-            posix_spawn_file_actions_t* file_actions
+            const char* path
+            const posix_spawn_file_actions_t* file_actions
+            const posix_spawnattr_t* attr
             char** argv
             char** envp
+      (ignoring restrict)
    */
-   PRINT("posix_spawn( %#lx, %#lx(%s), %#lx, %#lx, %#lx )",
-         ARG1, ARG2, ARG2 ? (HChar*)ARG2 : "(null)", ARG3, ARG4, ARG5 );
+   PRINT("posix_spawn( %#lx, %#lx(%s), %#lx, %#lx, %#lx, %#lx )",
+         ARG1, ARG2, ARG2 ? (HChar*)ARG2 : "(null)", ARG3, ARG4, ARG5, ARG6 );
 
    /* Standard pre-syscall checks */
 
-   PRE_REG_READ5(int, "posix_spawn", vki_pid_t*, pid, char*, path,
-                 void*, file_actions, char**, argv, char**, envp );
+   PRE_REG_READ6(int, "posix_spawn", vki_pid_t*, pid, char*, path,
+                 vki_posix_spawn_file_actions_t*, file_actions,
+                 vki_posix_spawnattr_t*, attrp,
+                 char**, argv, char**, envp );
    if (ARG1 != 0) {
       PRE_MEM_WRITE("posix_spawn(pid)", ARG1, sizeof(vki_pid_t) );
    }
    PRE_MEM_RASCIIZ("posix_spawn(path)", ARG2);
    // DDD: check file_actions
-   if (ARG4 != 0)
-      pre_argv_envp( ARG4, tid, "posix_spawn(argv)",
-                                "posix_spawn(argv[i])" );
    if (ARG5 != 0)
-      pre_argv_envp( ARG5, tid, "posix_spawn(envp)",
+      pre_argv_envp( ARG5, tid, "posix_spawn(argv)",
+                                "posix_spawn(argv[i])" );
+   if (ARG6 != 0)
+      pre_argv_envp( ARG6, tid, "posix_spawn(envp)",
                                 "posix_spawn(envp[i])" );
 
    if (0)
-   VG_(printf)("posix_spawn( %#lx, %#lx(%s), %#lx, %#lx, %#lx )\n",
-         ARG1, ARG2, ARG2 ? (HChar*)ARG2 : "(null)", ARG3, ARG4, ARG5 );
+   VG_(printf)("posix_spawn( %#lx, %#lx(%s), %#lx, %#lx, %#lx, %#lx )\n",
+         ARG1, ARG2, ARG2 ? (HChar*)ARG2 : "(null)", ARG3, ARG4, ARG5, ARG6 );
 
    /* Now follows a bunch of logic copied from PRE(sys_execve) in
       syswrap-generic.c. */
@@ -3887,7 +3925,7 @@ PRE(posix_spawn)
    // Decide whether or not we want to follow along
    { // Make 'child_argv' be a pointer to the child's arg vector
      // (skipping the exe name)
-     const HChar** child_argv = (const HChar**)ARG4;
+     const HChar** child_argv = (const HChar**)ARG5;
      if (child_argv && child_argv[0] == NULL)
         child_argv = NULL;
      trace_this_child = VG_(should_we_trace_this_child)( (HChar*)ARG2, child_argv );
@@ -3949,21 +3987,21 @@ PRE(posix_spawn)
    //
    // Then, if tracing the child, set VALGRIND_LIB for it.
    //
-   if (ARG5 == 0) {
+   if (ARG6 == 0) {
       envp = NULL;
    } else {
-      envp = VG_(env_clone)( (HChar**)ARG5 );
+      envp = VG_(env_clone)( (HChar**)ARG6 );
       vg_assert(envp);
       VG_(env_remove_valgrind_env_stuff)( envp, /* ro_strings */ False, NULL);
    }
 
    if (trace_this_child) {
-      // Set VALGRIND_LIB in ARG5 (the environment)
+      // Set VALGRIND_LIB in ARG6 (the environment)
       VG_(env_setenv)( &envp, VALGRIND_LIB, VG_(libdir));
    }
 
    // Set up the child's args.  If not tracing it, they are
-   // simply ARG4.  Otherwise, they are
+   // simply ARG5.  Otherwise, they are
    //
    // [launcher_basename] ++ VG_(args_for_valgrind) ++ [ARG2] ++ ARG4[1..]
    //
@@ -3971,7 +4009,7 @@ PRE(posix_spawn)
    // are omitted.
    //
    if (!trace_this_child) {
-      argv = (HChar**)ARG4;
+      argv = (HChar**)ARG6;
    } else {
       vg_assert( VG_(args_for_valgrind) );
       vg_assert( VG_(args_for_valgrind_noexecpass) >= 0 );
@@ -3986,7 +4024,7 @@ PRE(posix_spawn)
       // name of client exe
       tot_args++;
       // args for client exe, skipping [0]
-      arg2copy = (HChar**)ARG4;
+      arg2copy = (HChar**)ARG5;
       if (arg2copy && arg2copy[0]) {
          for (i = 1; arg2copy[i]; i++)
             tot_args++;
@@ -4027,12 +4065,13 @@ PRE(posix_spawn)
    /* Let the call go through as usual.  However, we have to poke
       the altered arguments back into the argument slots. */
    ARG2 = (UWord)path;
-   ARG4 = (UWord)argv;
-   ARG5 = (UWord)envp;
+   ARG5 = (UWord)argv;
+   ARG6 = (UWord)envp;
 
    /* not to mention .. */
    *flags |= SfMayBlock;
 }
+
 POST(posix_spawn)
 {
    vg_assert(SUCCESS);
diff --git a/include/vki/vki-darwin.h b/include/vki/vki-darwin.h
index 1aab28f33d..8957d60b00 100644
--- a/include/vki/vki-darwin.h
+++ b/include/vki/vki-darwin.h
@@ -1339,4 +1339,9 @@ struct vki_necp_agent_use_parameters {
 
 #endif /* DARWIN_VERS >= DARWIN_10_12 */
 
+#include <spawn.h>
+
+typedef posix_spawn_file_actions_t vki_posix_spawn_file_actions_t;
+typedef posix_spawnattr_t vki_posix_spawnattr_t;
+
 #endif

[Valgrind-developers] [valgrind] FreeBSD syscall: add wrapper for pdwait system call

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=8811654d17236842acd1703ef23869e8e3578c92

commit 8811654d17236842acd1703ef23869e8e3578c92
Author: Paul Floyd <pj...@wa...>
Date:   Sat Feb 28 12:01:31 2026 +0100

    FreeBSD syscall: add wrapper for pdwait system call
    
    Also add 516748 to NEWS. It's done for FreeBSD and finding syscalls
    like that is quite hard.

Diff:
---
 NEWS                                         |  4 ++-
 coregrind/m_syswrap/syswrap-freebsd.c        | 52 +++++++++++++++++++++++-----
 memcheck/tests/freebsd/scalar.c              | 35 +++++++++++++++++++
 memcheck/tests/freebsd/scalar.stderr.exp     | 30 ++++++++++++++++
 memcheck/tests/freebsd/scalar.stderr.exp-x86 | 30 ++++++++++++++++
 5 files changed, 141 insertions(+), 10 deletions(-)

diff --git a/NEWS b/NEWS
index 88a2d9be93..eee47e3402 100644
--- a/NEWS
+++ b/NEWS
@@ -73,7 +73,7 @@ are not entered into bugzilla tend to get forgotten about or ignored.
         '-Wno-alloc-size-larger-than=18446744073709551615'
 512030  s390x: bfp-convert testcase fails
 512037  malloc trace does not print free size or alignment
-512571  regtest problems with darwin dsymuti
+512571  regtest problems with darwin dsymutil
 513257  Add missing syswraps for lsm_list_modules
 513522  m_libcassert.c: 'ordered comparison of pointer with integer zero'
         compiler warning
@@ -95,6 +95,8 @@ are not entered into bugzilla tend to get forgotten about or ignored.
 515810  Update the LTP version in valgrind testsuite to 20260130
 515992  Add FreeBSD /proc virtualisation for cmdline and file
 516090  Regression : Linux FreeBSD and Darwin: refactor *at syscall dirfd checks
+516748  Incorrect use of SET_STATUS_Failure for syscall wrappers that return
+        error codes rather than -1 on error
 
 To see details of a given bug, visit
   https://bugs.kde.org/show_bug.cgi?id=XXXXXX
diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index ac7243d453..c2e2f50dc9 100644
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -6168,13 +6168,13 @@ POST(sys_rctl_remove_rule)
 }
 
 // SYS_posix_fallocate  530
-// x86/amd64
+// x86/amd64/arm64
 
 // SYS_posix_fadvise 531
-// x86/amd64
+// x86/amd64/arm64
 
 // SYS_wait6   532
-// amd64 / x86
+// x86/amd64/arm64
 
 // SYS_cap_rights_limit 533
 //int cap_rights_limit(int fd, const cap_rights_t *rights);
@@ -7360,6 +7360,39 @@ PRE(sys_jail_remove_jd)
        SET_STATUS_Failure(VKI_EBADF);
 }
 
+// SYS_pdwait   601
+// pid_t pdwait(int fd, int *status, int options,
+//              struct __wrusage *wrusage, siginfo_t *infop);
+PRE(sys_pdwait)
+{
+   PRINT("sys_pdwait ( %" FMT_REGWORD "d, %#" FMT_REGWORD "x, %" FMT_REGWORD "d, %#" FMT_REGWORD "x, %#" FMT_REGWORD "x )",
+         SARG1, ARG2, SARG3, ARG4, ARG5);
+   PRE_REG_READ5(pid_t, "pdwait", int, fd, int *, status, int, options,
+                 struct vki___wrusage *, wrusage, vki_siginfo_t *,infop);
+   PRE_MEM_WRITE("pdwait(status)", ARG2, sizeof(int));
+   if (ARG5) {
+      PRE_MEM_WRITE("pdwait(wrusage)", ARG4, sizeof(struct vki___wrusage));
+   }
+   if (ARG6) {
+      PRE_MEM_WRITE("pdwait(infop)", ARG5, sizeof(vki_siginfo_t));
+   }
+   if (!ML_(fd_allowed)(ARG1, "pdwait", tid, False)) {
+      SET_STATUS_Failure(VKI_EBADF);
+   }
+}
+
+POST(sys_pdwait)
+{
+   POST_MEM_WRITE(ARG2, sizeof(int));
+   if (ARG5) {
+      POST_MEM_WRITE(ARG4, sizeof(struct vki___wrusage));
+   }
+
+   if (ARG6) {
+      POST_MEM_WRITE(ARG5, sizeof(vki_siginfo_t));
+   }
+}
+
 #undef PRE
 #undef POST
 
@@ -8075,12 +8108,13 @@ const SyscallTableEntry ML_(syscall_table)[] = {
    GENXY(__NR_getgroups,        sys_getgroups),         // 596
 #endif
 
-    BSDX_(__NR_jail_attach_jd,  sys_jail_attach_jd),    // 597
-    BSDX_(__NR_jail_remove_jd,  sys_jail_remove_jd),    // 598
-    BSDX_(__NR_kexec_load,      sys_kexec_load),        // 599
-    // we only have partial support for rfork, so mark pdrfork
-    // as not implemented for the moment
-    GENX_(__NR_pdrfork,         sys_ni_syscall),        // 600
+   BSDX_(__NR_jail_attach_jd,  sys_jail_attach_jd),    // 597
+   BSDX_(__NR_jail_remove_jd,  sys_jail_remove_jd),    // 598
+   BSDX_(__NR_kexec_load,      sys_kexec_load),        // 599
+   // we only have partial support for rfork, so mark pdrfork
+   // as not implemented for the moment
+   GENX_(__NR_pdrfork,         sys_ni_syscall),        // 600
+   BSDXY(__NR_pdwait,          sys_pdwait),            // 601
 
    BSDX_(__NR_freebsd_fake_sigreturn,   sys_fake_sigreturn), // 1000, fake sigreturn
 
diff --git a/memcheck/tests/freebsd/scalar.c b/memcheck/tests/freebsd/scalar.c
index 08272c1fad..5d42d1da5e 100644
--- a/memcheck/tests/freebsd/scalar.c
+++ b/memcheck/tests/freebsd/scalar.c
@@ -2629,6 +2629,41 @@ int main(void)
    FAKE_SY("\n");
 #endif
 
+   /* SYS_pdwait                  601 */
+#if defined(SYS_pdwait)
+   GO(SYS_pdwait, "5s 3m");
+   SY(SYS_pdwait, x0+10000000, x0+1, x0, x0+1, x0+1); FAIL;
+#else
+   FAKE_GO("601:              SYS_pdwait 5s 3m");
+   FAKE_SY("Syscall param pdwait(fd) contains uninitialised byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(status) contains uninitialised byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(options) contains uninitialised byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(wrusage) contains uninitialised byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(infop) contains uninitialised byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(status) points to unaddressable byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY(" Address 0x........ is not stack'd, malloc'd or (recently) free'd\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(wrusage) points to unaddressable byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY(" Address 0x........ is not stack'd, malloc'd or (recently) free'd\n");
+   FAKE_SY("\n");
+   FAKE_SY("Syscall param pdwait(infop) points to unaddressable byte(s)\n");
+   FAKE_SY("   ...\n");
+   FAKE_SY(" Address 0x........ is not stack'd, malloc'd or (recently) free'd\n");
+   FAKE_SY("\n");
+#endif
+
    // no such syscall...
    GO(9999, "1e");
    SY(9999); FAIL;
diff --git a/memcheck/tests/freebsd/scalar.stderr.exp b/memcheck/tests/freebsd/scalar.stderr.exp
index f83467ce2d..365413c66a 100644
--- a/memcheck/tests/freebsd/scalar.stderr.exp
+++ b/memcheck/tests/freebsd/scalar.stderr.exp
@@ -5920,6 +5920,36 @@ Syscall param kexec_load(segments) points to unaddressable byte(s)
    ...
  Address 0x........ is not stack'd, malloc'd or (recently) free'd
 
+---------------------------------------------------------
+601:              SYS_pdwait 5s 3m
+---------------------------------------------------------
+Syscall param pdwait(fd) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(status) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(options) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(wrusage) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(infop) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(status) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param pdwait(wrusage) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param pdwait(infop) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
 ---------------------------------------------------------
 9999:                    9999 1e
 ---------------------------------------------------------
diff --git a/memcheck/tests/freebsd/scalar.stderr.exp-x86 b/memcheck/tests/freebsd/scalar.stderr.exp-x86
index 805bc19c72..8f3f5e1651 100644
--- a/memcheck/tests/freebsd/scalar.stderr.exp-x86
+++ b/memcheck/tests/freebsd/scalar.stderr.exp-x86
@@ -5992,6 +5992,36 @@ Syscall param kexec_load(segments) points to unaddressable byte(s)
    ...
  Address 0x........ is not stack'd, malloc'd or (recently) free'd
 
+---------------------------------------------------------
+601:              SYS_pdwait 5s 3m
+---------------------------------------------------------
+Syscall param pdwait(fd) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(status) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(options) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(wrusage) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(infop) contains uninitialised byte(s)
+   ...
+
+Syscall param pdwait(status) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param pdwait(wrusage) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param pdwait(infop) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
 ---------------------------------------------------------
 9999:                    9999 1e
 ---------------------------------------------------------

[Valgrind-developers] [valgrind] Clean up setting carry flag in VG_(fixup_guest_state_after_syscall_interrupted)

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=9529ce722eea10a32cbeefe1bafc8745b565f8fa

commit 9529ce722eea10a32cbeefe1bafc8745b565f8fa
Author: Paul Floyd <pj...@wa...>
Date:   Fri Feb 27 21:26:23 2026 +0100

    Clean up setting carry flag in VG_(fixup_guest_state_after_syscall_interrupted)
    
    This wasn't consistent (not at all for Darwin, not checking SfNoWriteResult
    on Solaris and a bit long winded on FreeBSD). Simplify the code for all
    3 platforms.

Diff:
---
 coregrind/m_syswrap/syswrap-main.c | 30 +++++++-----------------------
 1 file changed, 7 insertions(+), 23 deletions(-)

diff --git a/coregrind/m_syswrap/syswrap-main.c b/coregrind/m_syswrap/syswrap-main.c
index 07f1930469..763833c526 100644
--- a/coregrind/m_syswrap/syswrap-main.c
+++ b/coregrind/m_syswrap/syswrap-main.c
@@ -3407,40 +3407,24 @@ VG_(fixup_guest_state_after_syscall_interrupted)( ThreadId tid,
          we expect our caller (the signal handler) will have fixed
          this up. */
 /* XXX: needed? */
-#if defined(VGP_x86_freebsd)
-      /* On FreeBSD, the success/fail status is returned to the caller
-        and still has to be fixed up here. */
+#if defined(VGP_x86_freebsd) || defined(VGP_x86_solaris) || defined(VGP_x86_darwin)
+      /* The %eax and %edx values are committed but the carry flag is still
+         uncommitted.  Save it now. */
       if (!(sci->flags & SfNoWriteResult)) {
-        if (sr_isError(sres))
-           LibVEX_GuestX86_put_eflag_c(1, &th_regs->vex);
-        else
-           LibVEX_GuestX86_put_eflag_c(0, &th_regs->vex);
+         LibVEX_GuestX86_put_eflag_c(sr_isError(sres), &th_regs->vex);
       }
-#elif defined(VGP_amd64_freebsd)
+#elif defined(VGP_amd64_freebsd) || defined(VGP_amd64_solaris) || defined(VGP_amd64_darwin)
       if (!(sci->flags & SfNoWriteResult)) {
-        if (sr_isError(sres))
-           LibVEX_GuestAMD64_put_rflag_c(1, &th_regs->vex);
-        else
-           LibVEX_GuestAMD64_put_rflag_c(0, &th_regs->vex);
+         LibVEX_GuestAMD64_put_rflag_c(sr_isError(sres), &th_regs->vex);
       }
 #elif defined(VGP_arm64_freebsd)
       if (!(sci->flags & SfNoWriteResult)) {
-         if (sr_isError(sres))
-            LibVEX_GuestARM64_put_nzcv_c(1, &th_regs->vex);
-         else
-            LibVEX_GuestARM64_put_nzcv_c(0, &th_regs->vex);
+         LibVEX_GuestARM64_put_nzcv_c(sr_isError(sres), &th_regs->vex);
       }
 #endif
       if (VG_(clo_trace_signals))
          VG_(message)( Vg_DebugMsg,
                        "  completed and committed: nothing to do\n");
-#     if defined(VGP_x86_solaris)
-      /* The %eax and %edx values are committed but the carry flag is still
-         uncommitted.  Save it now. */
-      LibVEX_GuestX86_put_eflag_c(sr_isError(sres), &th_regs->vex);
-#     elif defined(VGP_amd64_solaris)
-      LibVEX_GuestAMD64_put_rflag_c(sr_isError(sres), &th_regs->vex);
-#     endif
       getSyscallStatusFromGuestState( &sci->status, &th_regs->vex );
       vg_assert(sci->status.what == SsComplete);
       VG_(post_syscall)(tid);

[Valgrind-developers] [valgrind] FreeBSD syscall: add pdrfork as sys_ni_syscall

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=5826ae56e202fe9008335fca98ab95d2e09b60ef

commit 5826ae56e202fe9008335fca98ab95d2e09b60ef
Author: Paul Floyd <pj...@wa...>
Date:   Fri Feb 27 20:31:10 2026 +0100

    FreeBSD syscall: add pdrfork as sys_ni_syscall
    
    rfork with a process descriptor. I'm not sure if we'll ever properly
    support any form of rfork.

Diff:
---
 coregrind/m_syswrap/priv_syswrap-freebsd.h | 4 ++--
 coregrind/m_syswrap/syswrap-freebsd.c      | 3 +++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/coregrind/m_syswrap/priv_syswrap-freebsd.h b/coregrind/m_syswrap/priv_syswrap-freebsd.h
index f8e3b7a5e9..32da698a26 100644
--- a/coregrind/m_syswrap/priv_syswrap-freebsd.h
+++ b/coregrind/m_syswrap/priv_syswrap-freebsd.h
@@ -84,7 +84,7 @@ DECL_TEMPLATE(freebsd, sys_fchflags) // 35
 DECL_TEMPLATE(freebsd, sys_freebsd10_pipe) // 42
 // generic getegid 43
 // generic profil redirect to ni_syscall 44
-// sys_ktrace refirect to ni_syscall 45
+// sys_ktrace redirect to ni_syscall 45
 // generic getgid 47
 DECL_TEMPLATE(freebsd, sys_getlogin) // 49
 DECL_TEMPLATE(freebsd, sys_setlogin) // 50
@@ -553,7 +553,7 @@ DECL_TEMPLATE(freebsd, sys_inotify_rm_watch) // 594
 DECL_TEMPLATE(freebsd, sys_jail_attach_jd) // 597
 DECL_TEMPLATE(freebsd, sys_jail_remove_jd) // 598
 DECL_TEMPLATE(freebsd, sys_kexec_load) // 599
-DECL_TEMPLATE(freebsd, sys_pdrfork) // 600
+// generic sys_pdrfork redirect to ni_syscall 600
 DECL_TEMPLATE(freebsd, sys_pdwait) // 601
 
 DECL_TEMPLATE(freebsd, sys_fake_sigreturn)
diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index 0bf93d87d5..ac7243d453 100644
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -8078,6 +8078,9 @@ const SyscallTableEntry ML_(syscall_table)[] = {
     BSDX_(__NR_jail_attach_jd,  sys_jail_attach_jd),    // 597
     BSDX_(__NR_jail_remove_jd,  sys_jail_remove_jd),    // 598
     BSDX_(__NR_kexec_load,      sys_kexec_load),        // 599
+    // we only have partial support for rfork, so mark pdrfork
+    // as not implemented for the moment
+    GENX_(__NR_pdrfork,         sys_ni_syscall),        // 600
 
    BSDX_(__NR_freebsd_fake_sigreturn,   sys_fake_sigreturn), // 1000, fake sigreturn

[Valgrind-developers] [valgrind] FreeBSD syscall: typo or copy/paste error in copy_file_range

[Paul F. <pa...@so...>]

https://sourceware.org/cgit/valgrind/commit/?id=bf111d83a883a169d5d999b6b69ad9d084008cb1

commit bf111d83a883a169d5d999b6b69ad9d084008cb1
Author: Paul Floyd <pj...@wa...>
Date:   Thu Feb 26 20:30:16 2026 +0100

    FreeBSD syscall: typo or copy/paste error in copy_file_range
    
    Was using
           !ML_(fd_allowed)(ARG3, "copy_file_range(infd)", tid, False))
    whilst ARGS is outfd, not infd.

Diff:
---
 coregrind/m_syswrap/syswrap-freebsd.c        |  2 +-
 memcheck/tests/freebsd/scalar.c              |  4 ++++
 memcheck/tests/freebsd/scalar.stderr.exp     | 29 ++++++++++++++++++++++++++++
 memcheck/tests/freebsd/scalar.stderr.exp-x86 | 29 ++++++++++++++++++++++++++++
 4 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index 010a09a699..0bf93d87d5 100644
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -6724,7 +6724,7 @@ PRE(sys_copy_file_range)
       valgrind itself uses some, so make sure someone didn't
       put in one of our own...  */
    if (!ML_(fd_allowed)(ARG1, "copy_file_range(infd)", tid, False) ||
-       !ML_(fd_allowed)(ARG3, "copy_file_range(infd)", tid, False))
+       !ML_(fd_allowed)(ARG3, "copy_file_range(outfd)", tid, False))
       SET_STATUS_Failure( VKI_EBADF );
 
    /* Now see if the offsets are defined. PRE_MEM_READ will
diff --git a/memcheck/tests/freebsd/scalar.c b/memcheck/tests/freebsd/scalar.c
index 4b50bd2551..08272c1fad 100644
--- a/memcheck/tests/freebsd/scalar.c
+++ b/memcheck/tests/freebsd/scalar.c
@@ -2184,6 +2184,10 @@ int main(void)
    GO(SYS_fhreadlink, "3s 2m");
    SY(SYS_fhreadlink, x0+1, x0+1, x0+10);
 
+   /* SYS_copy_file_range         569 */
+   GO(SYS_copy_file_range, "6s 2m");
+   SY(SYS_copy_file_range, x0-1, x0+1, x0-1, x0+1, x0+2, x0+12345);
+
    // __FreeBSD_version 1201522
    // __FreeBSD_version 1300045
    /* SYS___sysctlbyname          570 */
diff --git a/memcheck/tests/freebsd/scalar.stderr.exp b/memcheck/tests/freebsd/scalar.stderr.exp
index c4ac630b85..f83467ce2d 100644
--- a/memcheck/tests/freebsd/scalar.stderr.exp
+++ b/memcheck/tests/freebsd/scalar.stderr.exp
@@ -5488,6 +5488,35 @@ Syscall param fhreadlink(buf) points to unaddressable byte(s)
    ...
  Address 0x........ is not stack'd, malloc'd or (recently) free'd
 
+---------------------------------------------------------
+569:     SYS_copy_file_range 6s 2m
+---------------------------------------------------------
+Syscall param copy_file_range("infd") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("inoffp") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("outfd") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("outoffp") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("len") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("flags") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range(inoffp) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param copy_file_range(outoffp) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
 ---------------------------------------------------------
 570:      SYS___sysctlbyname (getoldlen) 3s 2m
 ---------------------------------------------------------
diff --git a/memcheck/tests/freebsd/scalar.stderr.exp-x86 b/memcheck/tests/freebsd/scalar.stderr.exp-x86
index c511a5764f..805bc19c72 100644
--- a/memcheck/tests/freebsd/scalar.stderr.exp-x86
+++ b/memcheck/tests/freebsd/scalar.stderr.exp-x86
@@ -5560,6 +5560,35 @@ Syscall param fhreadlink(buf) points to unaddressable byte(s)
    ...
  Address 0x........ is not stack'd, malloc'd or (recently) free'd
 
+---------------------------------------------------------
+569:     SYS_copy_file_range 6s 2m
+---------------------------------------------------------
+Syscall param copy_file_range("infd") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("inoffp") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("outfd") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("outoffp") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("len") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range("flags") contains uninitialised byte(s)
+   ...
+
+Syscall param copy_file_range(inoffp) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
+Syscall param copy_file_range(outoffp) points to unaddressable byte(s)
+   ...
+ Address 0x........ is not stack'd, malloc'd or (recently) free'd
+
 ---------------------------------------------------------
 570:      SYS___sysctlbyname (getoldlen) 3s 2m
 ---------------------------------------------------------