Release Cosmopolitan v3.6.2

Our cosmocc binaries are now built with GCC 14.1, using the Cosmo commit
efb3a34608 from yesterday.

GCC is now configured using --enable-analyzer so you can use -fanalyzer.

Makefile

@@ -150,10 +150,10 @@ export MODE
 export SOURCE_DATE_EPOCH
 export TMPDIR
 
-COSMOCC = .cosmocc/3.5.7
+COSMOCC = .cosmocc/3.6.0
 BOOTSTRAP = $(COSMOCC)/bin
 TOOLCHAIN = $(COSMOCC)/bin/$(ARCH)-linux-cosmo-
-DOWNLOAD := $(shell build/download-cosmocc.sh $(COSMOCC) 3.5.7 596876951b62ad2530c63afc40edd805d751fcb2416e544d249af04ad00bb4ed)
+DOWNLOAD := $(shell build/download-cosmocc.sh $(COSMOCC) 3.6.0 4918c45ac3e0972ff260e2a249e25716881e39fb679d5e714ae216a2ef6c3f7e)
 
 AS = $(TOOLCHAIN)as
 CC = $(TOOLCHAIN)gcc
@@ -293,8 +293,7 @@ include third_party/openmp/BUILD.mk		# │
 include third_party/pcre/BUILD.mk		# │
 include third_party/less/BUILD.mk		# │
 include net/https/BUILD.mk			# │
-include third_party/regex/BUILD.mk		# │
-include third_party/bash/BUILD.mk		#─┘
+include third_party/regex/BUILD.mk		#─┘
 include third_party/tidy/BUILD.mk
 include third_party/BUILD.mk
 include third_party/nsync/testing/BUILD.mk

README.md

@@ -244,7 +244,7 @@ server. You're welcome to join us! <https://discord.gg/FwAVVu7eJ4>
 
 | Platform       | Min Version | Circa |
 | :---           | ---:        | ---:  |
-| AMD            | K8 Venus    | 2005  |
+| AMD            | K8          | 2003  |
 | Intel          | Core        | 2006  |
 | Linux          | 2.6.18      | 2007  |
 | Windows        | 8 [1]       | 2012  |

ape/specification.md

@@ -36,8 +36,9 @@ considered an APE program.
 
 This is the canonical magic used by almost all APE programs. It enables
 maximum portability between OSes. When interpreted as a shell script, it
-is assiging a single quoted string to an unused variable. The shell will
-then ignore subsequent binary content that's placed inside the string.
+is assigning a single quoted string to an unused variable. The shell
+will then ignore subsequent binary content that's placed inside the
+string.
 
 It is strongly recommended that this magic value be immediately followed
 by a newline (\n or hex 0a) character. Some shells, e.g. FreeBSD SH and
@@ -167,12 +168,12 @@ printf '\177ELF\2\1\1\011\0\0\0\0\0\0\0\0\2\0\076\0\1\0\0\0\166\105\100\000\000\
 
 This `printf` statement MUST appear in the first 8192 bytes of the APE
 executable, so as to limit how much of the initial portion of a file an
-intepreter must load.
+interpreter must load.
 
-Multiple such `printf` statements MAY appear in hte first 8192 bytes, in
+Multiple such `printf` statements MAY appear in the first 8192 bytes, in
 order to specify multiple architectures. For example, fat binaries built
 by the `apelink` program (provided by Cosmo Libc) will have two encoded
-ELF headers, for amd64 and arm64, each of which point into the proper
+ELF headers, for AMD64 and ARM64, each of which point into the proper
 file offsets for their respective native code. Therefore, kernels and
 interpreters which load the APE format directly MUST check the
 `e_machine` field of the `Elf64_Ehdr` that's decoded from the octal
@@ -238,11 +239,11 @@ iterations over APE's history before we eventually got it right:
 - `arg=$((  9293))` b/c busybox sh disliked quoted space
 - `arg=9293  ` is generated by modern apelink program
 
-Software that parses the APE file format, which needs to extract to be
-able extract the Macho-O x86-64 header SHOULD support the old binaries
-that use the previous encodings. To make backwards compatibility simple
-the following regular expression may be used, which generalizes to all
-defined formats:
+Software that parses the APE file format, which needs to extract the
+Macho-O x86-64 header SHOULD support the old binaries that use the
+previous encodings. To make backwards compatibility simple the following
+regular expression may be used, which generalizes to all defined
+formats:
 
 ```c
 regcomp(&rx,
@@ -269,3 +270,434 @@ regcomp(&rx,
 
 For further details, see the canonical implementation in
 `cosmopolitan/tool/build/assimilate.c`.
+
+## Static Linking
+
+Actually Portable Executables are always statically linked. This
+revision of the specification does not define any facility for storing
+code in dynamic shared objects.
+
+Cosmopolitan Libc provides a solution that enables APE binaries have
+limited access to dlopen(). By manually loading a platform-specific
+executable and asking the OS-specific libc's dlopen() to load
+OS-specific libraries, it becomes possible to use GPUs and GUIs. This
+has worked great for AI projects like llamafile.
+
+There is no way for an Actually Portable Executable to interact with
+OS-specific dynamic shared object extension modules to programming
+languages. For example, a Lua interpreter compiled as an Actually
+Portable Executable would have no way of linking extension libraries
+downloaded from the Lua Rocks package manager. This is primarily because
+different OSes define incompatible ABIs.
+
+While it was possible to polyglot PE+ELF+MachO to create multi-OS
+executables, it simply isn't possible to do that same thing for
+DLL+DYLIB+SO. Therefore, in order to have DSOs, APE would need to either
+choose one of the existing formats or invent one of its own, and then
+develop its own parallel ecosystem of extension software. In the future,
+the APE specification may expand to encompass this. However the focus to
+date has been exclusively on executables with limited dlopen() support.
+
+## Application Binary Interface (ABI)
+
+APE binaries use the System V ABI, as defined by:
+
+- [System V ABI - AMD64 Architecture Processor Supplement](https://gitlab.com/x86-psABIs/x86-64-ABI)
+- AARCH64 has a uniform consensus defined by ARM Limited
+
+There are however a few changes we've had to make.
+
+### No Red Zone
+
+Actually Portable Executables that have Windows and/or bare metal in
+their support vector MUST be compiled using `-mno-red-zone`. This is
+because, on Windows, DLLs and other software lurking in the va-space
+might use tricks like SetThreadContext() to take control of a thread
+whereas on bare metal, it's also generally accepted that kernel-mode
+code cannot assume a red zone either due to hardware interrupts that
+pull the exact same kinds of stunts.
+
+APE software that only has truly System V ABI conformant OSes (e.g.
+Linux) in their support vector MAY use the red zone optimization.
+
+### Thread Local Storage
+
+#### aarch64
+
+Here's the TLS memory layout on aarch64:
+
+```
+           x28
+        %tpidr_el0
+            │
+            │    _Thread_local
+        ┌───┼───┬──────────┬──────────┐
+        │tib│dtv│  .tdata  │  .tbss   │
+        ├───┴───┴──────────┴──────────┘
+        │
+    __get_tls()
+```
+
+The ARM64 code in actually portable executables use the `x28` register
+to store the address of the thread information block. All aarch64 code
+linked into these executables SHOULD be compiled with `-ffixed-x28`
+which is supported by both Clang and GCC.
+
+The runtime library for an actually portable executables MAY choose to
+use `tpidr_el0` instead, if OSes like MacOS aren't being targeted. For
+example, if the goal is to create a Linux-only fat binary linker program
+for Musl Libc, then choosing to use the existing `tpidr_el0` convention
+would be friction-free alternative.
+
+It's not possible for an APE runtime that targets the full range of OSes
+to use the `tpidr_el0` register for TLS because Apple won't allow it. On
+MacOS ARM64 systems, this register can only be used by a runtime to
+implement the `sched_getcpu()` system call. It's reserved by MacOS.
+
+#### x86-64
+
+Here's the TLS memory layout on x86_64:
+
+```
+                          __get_tls()
+                              │
+                             %fs OpenBSD/NetBSD
+           _Thread_local      │
+    ┌───┬──────────┬──────────┼───┐
+    │pad│  .tdata  │  .tbss   │tib│
+    └───┴──────────┴──────────┼───┘
+                              │
+   Linux/FreeBSD/Windows/Mac %gs
+```
+
+Quite possibly the greatest challenge in Actually Portable Executable
+working, has been overcoming the incompatibilities between OSes in how
+thread-local storage works on x86-64. The AMD64 architecture defines two
+special segment registers. Every OS uses one of these segment registers
+to implement TLS support. However not all OSes agree on which register
+to use. Some OSes grant userspace the power to define either of these
+registers to hold any value that is desired. Some OSes only effectively
+allow a single one of them to be changed. Lastly, some OSes, e.g.
+Windows, claim ownership of the memory layout these registers point
+towards too.
+
+Here's a breakdown on how much power is granted to userspace runtimes by
+each OS when it comes to changing amd64 segment registers.
+
+|         | %fs          | %gs          |
+|---------|--------------|--------------|
+| Linux   | unrestricted | unrestricted |
+| MacOS   | inaccessible | unrestricted |
+| Windows | inaccessible | restricted   |
+| FreeBSD | unrestricted | unrestricted |
+| NetBSD  | unrestricted | broken       |
+| OpenBSD | unrestricted | inaccessible |
+
+Therefore, regardless of which register one we choose, some OSes are
+going to be incompatible.
+
+APE binaries are always built with a Linux compiler. So another issue
+arises in the fact that our Linux-flavored GCC and Clang toolchains
+(which are used to produce cross-OS binaries) are also only capable of
+producing TLS instructions that use the %fs convention.
+
+To solve these challenges, the `cosmocc` compiler will rewrite binary
+objects after they've been compiled by GCC, so that the `%gs` register
+is used, rather than `%fs`. Morphing x86-64 binaries after they've been
+compiled is normally difficult, due to the complexity of the machine
+instruction language. However GCC provides `-mno-tls-direct-seg-refs`
+which greatly reduces the complexity of this task. This flag forgoes
+some optimizations to make the generated code simpler. Rather than doing
+clever arithmetic with `%fs` prefixes, the compiler will always generate
+the thread information block address load as a separate instruction.
+
+```c
+// Change AMD code to use %gs:0x30 instead of %fs:0
+// We assume -mno-tls-direct-seg-refs has been used
+static void ChangeTlsFsToGs(unsigned char *p, size_t n) {
+  unsigned char *e = p + n - 9;
+  while (p <= e) {
+    // we're checking for the following expression:
+    //   0144 == p[0] &&           // %fs
+    //   0110 == (p[1] & 0373) &&  // rex.w (and ignore rex.r)
+    //   (0213 == p[2] ||          // mov reg/mem → reg (word-sized)
+    //   0003 == p[2]) &&          // add reg/mem → reg (word-sized)
+    //   0004 == (p[3] & 0307) &&  // mod/rm (4,reg,0) means sib → reg
+    //   0045 == p[4] &&           // sib (5,4,0) → (rbp,rsp,0) → disp32
+    //   0000 == p[5] &&           // displacement (von Neumann endian)
+    //   0000 == p[6] &&           // displacement
+    //   0000 == p[7] &&           // displacement
+    //   0000 == p[8]              // displacement
+    uint64_t w = READ64LE(p) & READ64LE("\377\373\377\307\377\377\377\377");
+    if ((w == READ64LE("\144\110\213\004\045\000\000\000") ||
+         w == READ64LE("\144\110\003\004\045\000\000\000")) &&
+        !p[8]) {
+      p[0] = 0145;  // change %fs to %gs
+      p[5] = 0x30;  // change 0 to 0x30
+      p += 9;
+    } else {
+      ++p;
+    }
+  }
+}
+```
+
+By favoring `%gs` we've now ensured friction-free compatibility for the
+APE runtime on MacOS, Linux, and FreeBSD which are all able to conform
+easily to this convention. However additional work needs to be done at
+runtime when an APE program is started on Windows, OpenBSD, and NetBSD.
+On these platforms, all executable pages must be faulted and morphed to
+fixup the TLS instructions.
+
+On OpenBSD and NetBSD, this is as simple as undoing the example
+operation above. Earlier at compile-time we turned `%fs` into `%gs`.
+Now, at runtime, `%gs` must be turned back into `%fs`. Since the
+executable is morphing itself, this is easier said than done.
+
+OpenBSD for example enforces a `W^X` invariant. Code that's executing
+can't modify itself at the same time. The way Cosmopolitan solves this
+is by defining a special part of the binary called `.text.privileged`.
+This section is aligned to page boundaries. A GNU ld linker script is
+used to ensure that code which morphs code is placed into this section,
+through the use of a header-defined cosmo-specific keyword `privileged`.
+Additionally, the `fixupobj` program is used by the Cosmo build system
+to ensure that compiled objects don't contain privileged functions that
+call non-privileged functions. Needless to say, `mprotect()` needs to be
+a privileged function, so that it can be used to disable the execute bit
+on all other parts of the executable except for the privileged section,
+thereby making it writable. Once this has been done, code can change.
+
+On Windows the displacement bytes of the TLS instruction are changed to
+use the `%gs:0x1480+i*8` ABI where `i` is a number assigned by the WIN32
+`TlsAlloc()` API. This avoids the need to call `TlsGetValue()` which is
+implemented this exact same way under the hood. Even though 0x1480 isn't
+explicitly documented by MSDN, this ABI is believed to be stable because
+MSVC generates binaries that use this offset directly. The only caveat
+is that `TlsAlloc()` must be called as early in the runtime init as
+possible, to ensure an index less than 64 is returned.
+
+### Thread Information Block (TIB)
+
+The Actually Portable Executable Thread Information Block (TIB) is
+defined by this version of the specification as follows:
+
+- The 64-bit TIB self-pointer is stored at offset 0x00.
+- The 64-bit TIB self-pointer is also stored at offset 0x30.
+- The 32-bit `errno` value is stored at offset 0x3c.
+
+All other parts of the thread information block should be considered
+unspecified and therefore reserved for future specifications.
+
+The APE thread information block is aligned on a 64-byte boundary.
+
+Cosmopolitan Libc v3.5.8 (c. 2024-07-21) currently implements a thread
+information block that's 512 bytes in size.
+
+### Foreign Function Calls
+
+Even though APE programs always use the System V ABI, there arises the
+occasional need to interface with foreign functions, e.g. WIN32. The
+`__attribute__((__ms_abi__))` annotation introduced by GCC v6 is used
+for this purpose.
+
+The ability to change a function's ABI on a case-by-case basis is
+surprisingly enough supported by GCC, Clang, NVCC, and even the AMD HIP
+compilers for both UNIX systems and Windows. All of these compilers
+support both the System V ABI and the Microsoft x64 ABI.
+
+APE binaries will actually favor the Microsoft ABI even when running on
+UNIX OSes for certain dlopen() use-cases. For example, if we control the
+code to a CUDA module, which we compile on each OS separately from our
+main APE binary, then any function that's inside the APE binary whose
+pointer may be passed into a foreign module SHOULD be compiled to use
+the Microsoft ABI. This is because in practice the OS-specific module
+may need to be compiled by MSVC, where MS ABI is the *only* ABI, which
+forces our UNIX programs to partially conform. Thankfully, all UNIX
+compilers support doing it on a case-by-case basis.
+
+### Char Signedness
+
+Actually Portable Executable defines `char` as signed.
+
+Therefore conformant APE software MUST use `-fsigned-char` when building
+code for aarch64, as well as any other architecture that (unlike x86-64)
+would otherwise define `char` as being `unsigned char` by default.
+
+This decision was one of the cases where it made sense to offer a more
+consistent runtime experience for fat multi-arch binaries. However you
+SHOULD still write code to assume `char` can go either way. But if all
+you care about is using APE, then you CAN assume `char` is signed.
+
+### Long Double
+
+On AMD64 platforms, APE binaries define `long double` as 80-bit.
+
+On ARM64 platforms, APE binaries define `long double` as 128-bit.
+
+We accept inconsistency in this case, because hardware acceleration is
+far more valuable than stylistic consistency in the case of mathematics.
+
+One challenge arises on AMD64 for supporting `long double` across OSes.
+Unlike UNIX systems, the Windows Executive on x86-64 initializes the x87
+FPU to have double (64-bit) precision rather than 80-bit. That's because
+code compiled by MSVC treats `long double` as though it were `double` to
+prefer always using the more modern SSE instructions. However System V
+requires genuine 80-bit `long double` support on AMD64.
+
+Therefore, if an APE program detects that it's been started on a Windows
+x86-64 system, then it SHOULD use the following assembly to initialize
+the x87 FPU in System V ABI mode.
+
+```asm
+	fldcw	1f(%rip)
+	.rodata
+	.balign	2
+//	8087 FPU Control Word
+//	 IM: Invalid Operation ───────────────┐
+//	 DM: Denormal Operand ───────────────┐│
+//	 ZM: Zero Divide ───────────────────┐││
+//	 OM: Overflow ─────────────────────┐│││
+//	 UM: Underflow ───────────────────┐││││
+//	 PM: Precision ──────────────────┐│││││
+//	 PC: Precision Control ───────┐  ││││││
+//	  {float,∅,double,long double}│  ││││││
+//	 RC: Rounding Control ──────┐ │  ││││││
+//	  {even, →-∞, →+∞, →0}      │┌┤  ││││││
+//	                           ┌┤││  ││││││
+//	                          d││││rr││││││
+1:	.short	0b00000000000000000001101111111
+	.previous
+```
+
+## Executable File Alignment
+
+Actually Portable Executable is a statically-linked flat executable file
+format that is, as a thing in itself, agnostic to file alignments. For
+example, the shell script payload at the beginning of the file and its
+statements have no such requirements. Alignment requirements are however
+imposed by the executable formats that APE wraps.
+
+1. ELF requires that file offsets be congruent with virtual addresses
+   modulo the CPU page size. So when we add a shell script to the start
+   of an executable, we need to round up to the page size in order to
+   maintain ELF's invariant. Although no such roundup is required on the
+   program segments once the invariant is restored. ELF loaders will
+   happily map program headers from arbitrary file intervals (which may
+   overlap) onto arbitrarily virtual intervals (which don't need to be
+   contiguous). In order to do that, the loaders will generally use
+   UNIX's mmap() function which is more restrictive and only accepts
+   addresses and offsets that are page aligned. To make it possible to
+   map an unaligned ELF program header that could potentially start and
+   stop at any byte, ELF loaders round-out the intervals, which means
+   adjacent unrelated data might also get mapped, which may need to be
+   explicitly zero'd. Thanks to the cleverness of ELF, it's possible to
+   have an executable file be very tiny, without needing any alignment
+   bytes, and it'll be loaded into a properly aligned virtual space
+   where segments can be as sparse as we want them to be.
+
+2. PE doesn't care about congruence and instead defines two separate
+   kinds of alignment. First, PE requires that the layout of segment
+   memory inside the file be aligned on at minimum the classic 512 byte
+   MS-DOS page size. This means that, unlike ELF, some alignment padding
+   may need to be encoded into the file, making it slightly larger. Next
+   PE imposes an alignment restriction on segments once they've been
+   mapped into the virtual address space, which must be rounded to the
+   system page size. Like ELF, PE segments need to be properly ordered
+   but they're allowed to drift apart once mapped in a non-contiguous
+   sparsely mapped way. When inserting shell script content at the start
+   of a PE file, the most problematic thing is the need to round up to
+   the 64kb system granularity, which results in a lot of needless bytes
+   of padding being inserted by a naive second-pass linker.
+
+3. Apple's Mach-O format is the strictest of them all. While both ELF
+   and PE are defined in such a way that invites great creativity, XNU
+   will simply refuse to an executable that does anything creative with
+   alignment. All loaded segments need to both start and end on a page
+   aligned address. XNU also wants segments to be contiguous similar to
+   portable executable, except it applies to both the file and virtual
+   spaces, which must follow the same structure.
+
+Actually Portable Executables must conform to the strictest requirements
+demanded by the support vector. Therefore an APE binary that has headers
+for all three of the above executable formats MUST conform to the Apple
+way of doing things. GNU ld linker scripts aren't very good at producing
+ELF binaries that rigidly conform to this simple naive layout. There are
+so many ways things can go wrong, where third party code might slip its
+own custom section name in-between the linker script sections that are
+explicitly defined, thereby causing ELF's powerful features to manifest
+and the resulting content overlapping. The best `ld` flag that helps is
+`--orphan-handling=error` which can help with explaining such mysteries.
+
+While Cosmopolitan was originally defined to just use stock GNU tools,
+this proved intractable over time, and the project has been evolving in
+the direction of building its own. Inventing the `apelink` program was
+what enabled the project to achieve multi-architecture binaries whereas
+previously it was only possible to do multi-OS binaries. In the future,
+our hope is that a fast power linker like Mold can be adapted to produce
+fat APE binaries directly from object files in one pass.
+
+## Position Independent Code
+
+APE doesn't currently support position independent executable formats.
+This is because APE was originally written for the GNU linker, where PIC
+and PIE were after-thoughts and never fully incorporated with the older
+more powerful linker script techniques upon which APE relies. Future
+iterations of this specification are intended to converge on modern
+standards, as our tooling becomes developed enough to support it.
+
+However this only applies to the wrapped executable formats themselves.
+While our convention to date has been to always load ELF programs at the
+4mb mark, this is not guaranteed across OSes and architectures. Programs
+should have no expectations that a program will be loaded to any given
+address. For example, Cosmo currently implements APE on AARCH64 as
+loading executables to a starting address of 0x000800000000. This
+address occupies a sweet spot of requirements.
+
+## Address Space
+
+In order to create a single binary that supports as many platforms as
+possible without needing to be recompiled, there's a very narrow range
+of addresses that can be used. That range is somewhere between 32 bits
+and 39 bits.
+
+- Embedded devices that claim to be 64-bit will oftentimes only support
+  a virtual address space that's 39 bits in size.
+
+- We can't load executable images on AARCH64 beneath 0x100000000 (4gb)
+  because Apple forbids doing that, possibly in an effort to enforce a
+  best practice for spotting 32-bit to 64-bit transition bugs. Please
+  note that this restriction only applies to Apple ARM64 systems. The
+  x86-64 version of XNU will happily load APE binaries to 0x00400000.
+
+- The AMD64 architecture on desktops and servers can usually be counted
+  upon to provide a 47-bit address space. The Linux Kernel for instance
+  grants each userspace program full dominion over addresses 0x00200000
+  through 0x00007fffffffffff provided the hardware supports this. On
+  modern workstations supporting Intel and AMD's new PML5T feature which
+  virtualizes memory using a radix trie that's five layers deep, Linux
+  is able to offer userspace its choice of fixed addresses from
+  0x00200000 through 0x00ffffffffffffff. The only exception to this rule
+  we've encountered so far is that Windows 7 and Windows Vista behaved
+  similar to embedded devices in reducing the number of va bits.
+
+## Page Size
+
+APE software MUST be page size agnostic. For many years the industry had
+converged on a strong consensus of having a page size that's 4096 bytes.
+However this convention was never guaranteed. New computers have become
+extremely popular, such as Apple Silicon, that use a 16kb page size.
+
+By convention, Cosmopolitan Libc currently generates ELF headers for
+x86-64 that are strictly aligned on a 4096-byte page size. On ARM64
+Cosmopolitan is currently implemented to always generate ELF headers
+aligned on a 16kb page size.
+
+In addition to being page size agnostic, APE software that cares about
+working correctly on Windows needs to be aware of the concept of
+allocation granularity. While the page size on Windows is generally 4kb
+in size, memory mappings can only be created on addresses that aligned
+to the system allocation granularity, which is generally 64kb. If you
+use a function like mmap() with Cosmopolitan Libc, then the `addr` and
+`offset` parameters need to be aligned to `sysconf(_SC_GRANSIZE)` or
+else your software won't work on Windows. Windows has other limitations
+too, such as lacking the ability to carve or punch holes in mappings.

build/config.mk

@@ -14,7 +14,6 @@ ENABLE_FTRACE = 1
 CONFIG_OFLAGS ?= -g -ggdb
 CONFIG_CCFLAGS += -O2 $(BACKTRACES)
 CONFIG_CPPFLAGS += -DSYSDEBUG
-TARGET_ARCH ?= -msse3
 endif
 ifeq ($(MODE), x86_64)
 ENABLE_FTRACE = 1
@@ -64,7 +63,6 @@ ENABLE_FTRACE = 1
 CONFIG_CCFLAGS += $(BACKTRACES) -O
 CONFIG_CPPFLAGS += -DSYSDEBUG -DDWARFLESS
 CONFIG_LDFLAGS += -S
-TARGET_ARCH ?= -msse3
 endif
 
 # Optimized Mode
@@ -84,7 +82,7 @@ ENABLE_FTRACE = 1
 CONFIG_OFLAGS ?= -g -ggdb
 CONFIG_CPPFLAGS += -DNDEBUG -DSYSDEBUG
 CONFIG_CCFLAGS += $(BACKTRACES) -O3 -fmerge-all-constants
-TARGET_ARCH ?= -march=native
+CONFIG_TARGET_ARCH ?= -march=native
 endif
 
 # Optimized Linux Mode
@@ -102,7 +100,20 @@ CONFIG_OFLAGS ?= -g -ggdb
 CONFIG_CPPFLAGS += -DNDEBUG -DSYSDEBUG -DSUPPORT_VECTOR=1
 CONFIG_CCFLAGS += -O3 -fmerge-all-constants
 CONFIG_COPTS += -mred-zone
-TARGET_ARCH ?= -march=native
+CONFIG_TARGET_ARCH ?= -march=native
+endif
+ifeq ($(MODE), x86_64-optlinux)
+CONFIG_OFLAGS ?= -g -ggdb
+CONFIG_CPPFLAGS += -DNDEBUG -DSYSDEBUG -DSUPPORT_VECTOR=1
+CONFIG_CCFLAGS += -O3 -fmerge-all-constants
+CONFIG_COPTS += -mred-zone
+CONFIG_TARGET_ARCH ?= -march=native
+endif
+ifeq ($(MODE), aarch64-optlinux)
+CONFIG_OFLAGS ?= -g -ggdb
+CONFIG_CPPFLAGS += -DNDEBUG -DSYSDEBUG -DSUPPORT_VECTOR=1
+CONFIG_CCFLAGS += -O3 -fmerge-all-constants
+CONFIG_COPTS += -mred-zone
 endif
 
 # Release Mode
@@ -123,7 +134,6 @@ endif
 ifeq ($(MODE), rel)
 CONFIG_CPPFLAGS += -DNDEBUG -DDWARFLESS
 CONFIG_CCFLAGS += $(BACKTRACES) -O2
-TARGET_ARCH ?= -msse3
 PYFLAGS += -O1
 endif
 
@@ -139,18 +149,32 @@ endif
 ifeq ($(MODE), dbg)
 ENABLE_FTRACE = 1
 CONFIG_OFLAGS ?= -g -ggdb
-CONFIG_CPPFLAGS += -DMODE_DBG -D__SANITIZE_UNDEFINED__
-CONFIG_CCFLAGS += $(BACKTRACES) -DSYSDEBUG -O0 -fno-inline
+OVERRIDE_CFLAGS += -O0
+OVERRIDE_CXXFLAGS += -O0
+CONFIG_CPPFLAGS += -DMODE_DBG -D__SANITIZE_UNDEFINED__ -Wno-unused-variable -Wno-unused-but-set-variable
+CONFIG_CCFLAGS += $(BACKTRACES) -DSYSDEBUG
+CONFIG_COPTS += -fsanitize=undefined
+OVERRIDE_CCFLAGS += -fno-pie
+QUOTA ?= -C64 -L300
+endif
+ifeq ($(MODE), x86_64-dbg)
+ENABLE_FTRACE = 1
+CONFIG_OFLAGS ?= -g -ggdb
+OVERRIDE_CFLAGS += -O0
+OVERRIDE_CXXFLAGS += -O0
+CONFIG_CPPFLAGS += -DMODE_DBG -D__SANITIZE_UNDEFINED__ -Wno-unused-variable -Wno-unused-but-set-variable
+CONFIG_CCFLAGS += $(BACKTRACES) -DSYSDEBUG
 CONFIG_COPTS += -fsanitize=undefined
-TARGET_ARCH ?= -msse3
 OVERRIDE_CCFLAGS += -fno-pie
 QUOTA ?= -C64 -L300
 endif
 ifeq ($(MODE), aarch64-dbg)
 ENABLE_FTRACE = 1
 CONFIG_OFLAGS ?= -g -ggdb
-CONFIG_CPPFLAGS += -DMODE_DBG -D__SANITIZE_UNDEFINED__
-CONFIG_CCFLAGS += $(BACKTRACES) -DSYSDEBUG -O0 -fno-inline -fdce
+OVERRIDE_CFLAGS += -O0 -fdce
+OVERRIDE_CXXFLAGS += -O0 -fdce
+CONFIG_CPPFLAGS += -DMODE_DBG -D__SANITIZE_UNDEFINED__ -Wno-unused-variable -Wno-unused-but-set-variable
+CONFIG_CCFLAGS += $(BACKTRACES) -DSYSDEBUG
 CONFIG_COPTS += -fsanitize=undefined
 QUOTA ?= -C64 -L300
 endif
@@ -170,7 +194,6 @@ ENABLE_FTRACE = 1
 CONFIG_OFLAGS ?= -g -ggdb
 CONFIG_CCFLAGS += $(BACKTRACES) -O2
 CONFIG_CPPFLAGS += -DSYSDEBUG -DSUPPORT_VECTOR=121
-TARGET_ARCH ?= -msse3
 endif
 
 # Tiny Mode
@@ -200,8 +223,6 @@ CONFIG_CCFLAGS +=			\
 	-momit-leaf-frame-pointer	\
 	-foptimize-sibling-calls	\
 	-DDWARFLESS
-TARGET_ARCH ?=				\
-	-msse3
 PYFLAGS +=				\
 	-O2				\
 	-B
@@ -221,8 +242,6 @@ CONFIG_CCFLAGS +=			\
 	-momit-leaf-frame-pointer	\
 	-foptimize-sibling-calls	\
 	-DDWARFLESS
-TARGET_ARCH ?=				\
-	-msse3
 PYFLAGS +=				\
 	-O2				\
 	-B
@@ -274,8 +293,6 @@ CONFIG_CCFLAGS +=			\
 	-fno-align-jumps		\
 	-fno-align-labels		\
 	-fno-align-loops
-TARGET_ARCH ?=				\
-	-msse3
 endif
 
 # Linux+BSD Tiny Mode
@@ -305,8 +322,6 @@ CONFIG_CCFLAGS +=		\
 	-fno-align-jumps	\
 	-fno-align-labels	\
 	-fno-align-loops
-TARGET_ARCH ?=			\
-	-msse3
 endif
 
 # Unix Tiny Mode
@@ -335,8 +350,6 @@ CONFIG_CCFLAGS +=		\
 	-fno-align-jumps	\
 	-fno-align-labels	\
 	-fno-align-loops
-TARGET_ARCH ?=			\
-	-msse3
 endif
 
 # Tiny Metallic Unix Mode
@@ -365,8 +378,6 @@ CONFIG_CCFLAGS +=		\
 	-fno-align-jumps	\
 	-fno-align-labels	\
 	-fno-align-loops
-TARGET_ARCH ?=			\
-	-msse3
 endif
 
 # no x87 instructions mode
@@ -388,7 +399,6 @@ ENABLE_FTRACE = 1
 CONFIG_COPTS += -mlong-double-64
 CONFIG_CCFLAGS += $(BACKTRACES) -O2
 CONFIG_CPPFLAGS += -DSYSDEBUG -DNOX87
-TARGET_ARCH ?= -msse3
 endif
 
 # LLVM Mode
@@ -401,7 +411,6 @@ endif
 #
 ifeq ($(MODE), llvm)
 .STRICT = 0
-TARGET_ARCH ?= -msse3
 CONFIG_CCFLAGS += $(BACKTRACES) -DSYSDEBUG -O2
 AS = clang
 CC = clang
@@ -444,7 +453,6 @@ ifeq ($(MODE), ansi)
 CONFIG_CFLAGS += -std=c11
 #CONFIG_CPPFLAGS += -ansi
 CONFIG_CXXFLAGS += -std=c++11
-TARGET_ARCH ?= -msse3
 endif
 
 ifneq ($(ENABLE_FTRACE),)
@@ -502,3 +510,5 @@ ifeq ($(ARCH), aarch64)
 CONFIG_CCFLAGS += -fpatchable-function-entry=7,6
 endif
 endif
+
+TARGET_ARCH ?= $(CONFIG_TARGET_ARCH)

build/definitions.mk

@@ -139,10 +139,10 @@ DEFAULT_CPPFLAGS +=							\
 	-isystem libc/isystem
 
 DEFAULT_CFLAGS =							\
-	-std=gnu2x
+	-std=gnu23
 
 DEFAULT_CXXFLAGS =							\
-	-std=gnu++20							\
+	-std=gnu++23							\
 	-fno-rtti							\
 	-fno-exceptions							\
 	-fuse-cxa-atexit						\

build/objdump

@@ -6,14 +6,14 @@ if [ -n "$OBJDUMP" ]; then
 fi
 
 find_objdump() {
-  if [ -x .cosmocc/3.3.5/bin/$1-linux-cosmo-objdump ]; then
-    OBJDUMP=.cosmocc/3.3.5/bin/$1-linux-cosmo-objdump
-  elif [ -x .cosmocc/3.3.5/bin/$1-linux-musl-objdump ]; then
-    OBJDUMP=.cosmocc/3.3.5/bin/$1-linux-musl-objdump
-  elif [ -x "$COSMO/.cosmocc/3.3.5/bin/$1-linux-cosmo-objdump" ]; then
-    OBJDUMP="$COSMO/.cosmocc/3.3.5/bin/$1-linux-cosmo-objdump"
-  elif [ -x "$COSMO/.cosmocc/3.3.5/bin/$1-linux-musl-objdump" ]; then
-    OBJDUMP="$COSMO/.cosmocc/3.3.5/bin/$1-linux-musl-objdump"
+  if [ -x .cosmocc/3.6.0/bin/$1-linux-cosmo-objdump ]; then
+    OBJDUMP=.cosmocc/3.6.0/bin/$1-linux-cosmo-objdump
+  elif [ -x .cosmocc/3.6.0/bin/$1-linux-musl-objdump ]; then
+    OBJDUMP=.cosmocc/3.6.0/bin/$1-linux-musl-objdump
+  elif [ -x "$COSMO/.cosmocc/3.6.0/bin/$1-linux-cosmo-objdump" ]; then
+    OBJDUMP="$COSMO/.cosmocc/3.6.0/bin/$1-linux-cosmo-objdump"
+  elif [ -x "$COSMO/.cosmocc/3.6.0/bin/$1-linux-musl-objdump" ]; then
+    OBJDUMP="$COSMO/.cosmocc/3.6.0/bin/$1-linux-musl-objdump"
   else
     echo "error: toolchain not found (try running 'cosmocc --update' or 'make' in the cosmo monorepo)" >&2
     exit 1

ctl/string.cc

@@ -21,6 +21,9 @@
 #include <__atomic/fence.h>
 #include <stdckdint.h>
 
+#include "libc/mem/mem.h"
+#include "libc/str/str.h"
+
 namespace ctl {
 
 void

dsp/core/core.h

@@ -9,14 +9,13 @@ int mulaw(int);
 int unmulaw(int);
 void *double2byte(long, const void *, double, double) vallocesque;
 void *byte2double(long, const void *, double, double) vallocesque;
-void *dct(float[restrict hasatleast 8][8], unsigned, float, float, float, float,
-          float);
-void *dctjpeg(float[restrict hasatleast 8][8], unsigned);
+void *dct(float[hasatleast 8][8], unsigned, float, float, float, float, float);
+void *dctjpeg(float[hasatleast 8][8], unsigned);
 double det3(const double[3][3]) nosideeffect;
-void *inv3(double[restrict 3][3], const double[restrict 3][3], double);
-void *matmul3(double[restrict 3][3], const double[3][3], const double[3][3]);
-void *vmatmul3(double[restrict 3], const double[3], const double[3][3]);
-void *matvmul3(double[restrict 3], const double[3][3], const double[3]);
+void *inv3(double[3][3], const double[3][3], double);
+void *matmul3(double[3][3], const double[3][3], const double[3][3]);
+void *vmatmul3(double[3], const double[3], const double[3][3]);
+void *matvmul3(double[3], const double[3][3], const double[3]);
 double rgb2stdtv(double) pureconst;
 double rgb2lintv(double) pureconst;
 double rgb2stdpc(double, double) pureconst;

dsp/core/dct.c

@@ -65,8 +65,8 @@
  *
  * @cost ~100ns
  */
-void *dct(float M[restrict hasatleast 8][8], unsigned stride, float c0,
-          float c1, float c2, float c3, float c4) {
+void *dct(float M[hasatleast 8][8], unsigned stride, float c0, float c1,
+          float c2, float c3, float c4) {
   unsigned y, x;
   for (y = 0; y < stride * 8; y += stride) {
     DCT(M[y][0], M[y][1], M[y][2], M[y][3], M[y][4], M[y][5], M[y][6], M[y][7],
@@ -79,7 +79,7 @@ void *dct(float M[restrict hasatleast 8][8], unsigned stride, float c0,
   return M;
 }
 
-void *dctjpeg(float M[restrict hasatleast 8][8], unsigned stride) {
+void *dctjpeg(float M[hasatleast 8][8], unsigned stride) {
   return dct(M, stride, .707106781f, .382683433f, .541196100f, 1.306562965f,
              .707106781f);
 }

dsp/core/inv3.c

@@ -30,7 +30,7 @@
  * @define 𝐀⁻¹=𝐁 such that 𝐀×𝐁=𝐁×𝐀=𝐈ₙ
  * @see det3()
  */
-void *inv3(double B[restrict 3][3], const double A[restrict 3][3], double d) {
+void *inv3(double B[3][3], const double A[3][3], double d) {
   d = d ? 1 / d : NAN;
   B[0][0] = (A[1][1] * A[2][2] - A[2][1] * A[1][2]) * d;
   B[0][1] = (A[2][1] * A[0][2] - A[0][1] * A[2][2]) * d;

dsp/core/matmul3.c

@@ -22,8 +22,7 @@
 /**
  * Multiplies 3×3 matrices.
  */
-void *matmul3(double R[restrict 3][3], const double A[3][3],
-              const double B[3][3]) {
+void *matmul3(double R[3][3], const double A[3][3], const double B[3][3]) {
   int i, j, k;
   memset(R, 0, sizeof(double) * 3 * 3);
   for (i = 0; i < 3; ++i) {

dsp/core/matvmul3.c

@@ -23,7 +23,7 @@
  *
  * @see vmatmul3() for noncommutative corollary
  */
-void *matvmul3(double R[restrict 3], const double M[3][3], const double V[3]) {
+void *matvmul3(double R[3], const double M[3][3], const double V[3]) {
   R[0] = V[0] * M[0][0] + V[1] * M[0][1] + V[2] * M[0][2];
   R[1] = V[0] * M[1][0] + V[1] * M[1][1] + V[2] * M[1][2];
   R[2] = V[0] * M[2][0] + V[1] * M[2][1] + V[2] * M[2][2];

dsp/core/vmatmul3.c

@@ -23,7 +23,7 @@
  *
  * @see matvmul3() for noncommutative corollary
  */
-void *vmatmul3(double R[restrict 3], const double V[3], const double M[3][3]) {
+void *vmatmul3(double R[3], const double V[3], const double M[3][3]) {
   R[0] = V[0] * M[0][0] + V[1] * M[1][0] + V[2] * M[2][0];
   R[1] = V[0] * M[0][1] + V[1] * M[1][1] + V[2] * M[2][1];
   R[2] = V[0] * M[0][2] + V[1] * M[1][2] + V[2] * M[2][2];

dsp/mpeg/macroblock.c

@@ -31,9 +31,8 @@
 #include "dsp/mpeg/video.h"
 #include "libc/log/check.h"
 
-forceinline void plm_video_process_macroblock(plm_video_t *self,
-                                              uint8_t *restrict d,
-                                              uint8_t *restrict s, int motion_h,
+forceinline void plm_video_process_macroblock(plm_video_t *self, uint8_t *d,
+                                              uint8_t *s, int motion_h,
                                               int motion_v, bool interpolate,
                                               unsigned BW) {
   unsigned si, di, max_address;
@@ -155,17 +154,17 @@ forceinline void plm_video_process_macroblock(plm_video_t *self,
   }
 }
 
-void plm_video_process_macroblock_8(plm_video_t *self, uint8_t *restrict d,
-                                    uint8_t *restrict s, int motion_h,
-                                    int motion_v, bool interpolate) {
+void plm_video_process_macroblock_8(plm_video_t *self, uint8_t *d, uint8_t *s,
+                                    int motion_h, int motion_v,
+                                    bool interpolate) {
   DCHECK_ALIGNED(8, d);
   DCHECK_ALIGNED(8, s);
   plm_video_process_macroblock(self, d, s, motion_h, motion_v, interpolate, 8);
 }
 
-void plm_video_process_macroblock_16(plm_video_t *self, uint8_t *restrict d,
-                                     uint8_t *restrict s, int motion_h,
-                                     int motion_v, bool interpolate) {
+void plm_video_process_macroblock_16(plm_video_t *self, uint8_t *d, uint8_t *s,
+                                     int motion_h, int motion_v,
+                                     bool interpolate) {
   DCHECK_ALIGNED(16, d);
   DCHECK_ALIGNED(16, s);
   plm_video_process_macroblock(self, d, s, motion_h, motion_v, interpolate, 16);

dsp/mpeg/video.h

@@ -51,10 +51,10 @@ typedef struct plm_video_t {
   int assume_no_b_frames;
 } plm_video_t;
 
-void plm_video_process_macroblock_8(plm_video_t *, uint8_t *restrict,
-                                    uint8_t *restrict, int, int, bool);
-void plm_video_process_macroblock_16(plm_video_t *, uint8_t *restrict,
-                                     uint8_t *restrict, int, int, bool);
+void plm_video_process_macroblock_8(plm_video_t *, uint8_t *, uint8_t *, int,
+                                    int, bool);
+void plm_video_process_macroblock_16(plm_video_t *, uint8_t *, uint8_t *, int,
+                                     int, bool);
 
 COSMOPOLITAN_C_END_
 #endif /* COSMOPOLITAN_DSP_MPEG_VIDEO_H_ */

dsp/scale/gyarados.c

@@ -53,11 +53,11 @@ struct SamplingSolution {
 static double ComputeWeight(double x) {
   if (-1.5 < x && x < 1.5) {
     if (-.5 < x && x < .5) {
-      return .75 - SQR(x);
+      return.75 - SQR(x);
     } else if (x < 0) {
-      return .5 * SQR(x + 1.5);
+      return.5 * SQR(x + 1.5);
     } else {
-      return .5 * SQR(x - 1.5);
+      return.5 * SQR(x - 1.5);
     }
   } else {
     return 0;
@@ -149,12 +149,11 @@ static int Sharpen(int ax, int bx, int cx) {
 
 static void GyaradosImpl(long dyw, long dxw, int dst[dyw][dxw], long syw,
                          long sxw, const int src[syw][sxw], long dyn, long dxn,
-                         long syn, long sxn, int tmp0[restrict dyn][sxn],
-                         int tmp1[restrict dyn][sxn],
-                         int tmp2[restrict dyn][dxn], long yfn, long xfn,
-                         const short fyi[dyn][yfn], const short fyw[dyn][yfn],
-                         const short fxi[dxn][xfn], const short fxw[dxn][xfn],
-                         bool sharpen) {
+                         long syn, long sxn, int tmp0[dyn][sxn],
+                         int tmp1[dyn][sxn], int tmp2[dyn][dxn], long yfn,
+                         long xfn, const short fyi[dyn][yfn],
+                         const short fyw[dyn][yfn], const short fxi[dxn][xfn],
+                         const short fxw[dxn][xfn], bool sharpen) {
   long i;
   int eax, dy, dx, sx;
   for (sx = 0; sx < sxn; ++sx) {

dsp/scale/magikarp.c

@@ -106,9 +106,9 @@ void *Magkern2xY(long ys, long xs, unsigned char p[ys][xs], long yn, long xn) {
   return p;
 }
 
-void *MagikarpY(long dys, long dxs, unsigned char d[restrict dys][dxs],
-                long sys, long sxs, const unsigned char s[sys][sxs], long yn,
-                long xn, const signed char K[8]) {
+void *MagikarpY(long dys, long dxs, unsigned char d[dys][dxs], long sys,
+                long sxs, const unsigned char s[sys][sxs], long yn, long xn,
+                const signed char K[8]) {
   long y, x;
   for (y = 0; y < yn; ++y) {
     for (x = 0; x < xn; ++x) {

examples/blas.cc

@@ -135,7 +135,7 @@ void sgemm(int m, int n, int k,      //
            const float *B, int ldb,  //
            float *C, int ldc) {
   int nth = sysconf(_SC_NPROCESSORS_ONLN);
-#pragma omp parallel for
+#pragma omp parallel for schedule(static)
   for (int ith = 0; ith < nth; ++ith) {
     ansiBLAS tb{k, A, lda, B, ldb, C, ldc, ith, nth};
     tb.matmul(m, n);

libc/calls/calls.h

@@ -69,48 +69,49 @@ COSMOPOLITAN_C_START_
 /*───────────────────────────────────────────────────────────────────────────│─╗
 │ cosmopolitan § system calls                                              ─╬─│┼
 ╚────────────────────────────────────────────────────────────────────────────│*/
+/* clang-format off */
 
 typedef int sig_atomic_t;
 
 bool32 isatty(int) libcesque;
-char *getcwd(char *, size_t) dontthrow;
-char *realpath(const char *, char *) libcesque __wur;
+char *getcwd(char *, size_t) dontthrow __write_only(1, 2);
+char *realpath(const char *, char *) libcesque __wur __read_only(1) __write_only(2);
 char *ttyname(int) libcesque;
-int access(const char *, int) libcesque;
-int chdir(const char *) libcesque;
-int chmod(const char *, unsigned) libcesque;
-int chown(const char *, unsigned, unsigned) libcesque;
-int chroot(const char *) libcesque;
+int access(const char *, int) libcesque __read_only(1);
+int chdir(const char *) libcesque __read_only(1);
+int chmod(const char *, unsigned) libcesque __read_only(1);
+int chown(const char *, unsigned, unsigned) libcesque __read_only(1);
+int chroot(const char *) libcesque __read_only(1);
 int close(int) libcesque;
 int close_range(unsigned, unsigned, unsigned) libcesque;
 int closefrom(int) libcesque;
-int creat(const char *, unsigned) libcesque;
+int creat(const char *, unsigned) libcesque __read_only(1);
 int dup(int) libcesque;
 int dup2(int, int) libcesque;
 int dup3(int, int, int) libcesque;
-int execl(const char *, const char *, ...) nullterminated() libcesque;
-int execle(const char *, const char *, ...) nullterminated((1)) libcesque;
-int execlp(const char *, const char *, ...) nullterminated() libcesque;
-int execv(const char *, char *const[]) libcesque;
-int execve(const char *, char *const[], char *const[]) libcesque;
-int execvp(const char *, char *const[]) libcesque;
-int faccessat(int, const char *, int, int) libcesque;
+int execl(const char *, const char *, ...) nullterminated() libcesque __read_only(1) __read_only(2);
+int execle(const char *, const char *, ...) nullterminated((1)) libcesque __read_only(1) __read_only(2);
+int execlp(const char *, const char *, ...) nullterminated() libcesque __read_only(1) __read_only(2);
+int execv(const char *, char *const[]) libcesque __read_only(1) __read_only(2);
+int execve(const char *, char *const[], char *const[]) libcesque __read_only(1) __read_only(2) __read_only(3);
+int execvp(const char *, char *const[]) libcesque __read_only(1) __read_only(2);
+int faccessat(int, const char *, int, int) libcesque __read_only(2);
 int fchdir(int) libcesque;
 int fchmod(int, unsigned) libcesque;
-int fchmodat(int, const char *, unsigned, int) libcesque;
+int fchmodat(int, const char *, unsigned, int) libcesque __read_only(2);
 int fchown(int, unsigned, unsigned) libcesque;
-int fchownat(int, const char *, unsigned, unsigned, int) libcesque;
+int fchownat(int, const char *, unsigned, unsigned, int) libcesque __read_only(2);
 int fcntl(int, int, ...) libcesque;
 int fdatasync(int) libcesque;
-int fexecve(int, char *const[], char *const[]) libcesque;
+int fexecve(int, char *const[], char *const[]) libcesque __read_only(2) __read_only(3);
 int flock(int, int) libcesque;
 int fork(void) libcesque;
 int fsync(int) libcesque;
 int ftruncate(int, int64_t) libcesque;
-int getdomainname(char *, size_t) libcesque;
-int getgroups(int, unsigned[]) libcesque;
-int gethostname(char *, size_t) libcesque;
-int getloadavg(double *, int) libcesque;
+int getdomainname(char *, size_t) libcesque __write_only(1, 2);
+int getgroups(int, unsigned[]) libcesque __write_only(2, 1);
+int gethostname(char *, size_t) libcesque __write_only(1, 2);
+int getloadavg(double *, int) libcesque __write_only(1, 2);
 int getpgid(int) libcesque;
 int getpgrp(void) libcesque nosideeffect;
 int getpid(void) libcesque nosideeffect;
@@ -121,35 +122,35 @@ int ioctl(int, unsigned long, ...) libcesque;
 int issetugid(void) libcesque;
 int kill(int, int) libcesque;
 int killpg(int, int) libcesque;
-int lchmod(const char *, unsigned) libcesque;
-int lchown(const char *, unsigned, unsigned) libcesque;
-int link(const char *, const char *) libcesque;
-int linkat(int, const char *, int, const char *, int) libcesque;
-int mincore(void *, size_t, unsigned char *) libcesque;
-int mkdir(const char *, unsigned) libcesque;
-int mkdirat(int, const char *, unsigned) libcesque;
-int mknod(const char *, unsigned, uint64_t) libcesque;
+int lchmod(const char *, unsigned) libcesque __read_only(1);
+int lchown(const char *, unsigned, unsigned) libcesque __read_only(1);
+int link(const char *, const char *) libcesque __read_only(1) __read_only(2);
+int linkat(int, const char *, int, const char *, int) libcesque __read_only(2) __read_only(4);
+int mincore(void *, size_t, unsigned char *) libcesque __read_only(1) __write_only(3);
+int mkdir(const char *, unsigned) libcesque __read_only(1);
+int mkdirat(int, const char *, unsigned) libcesque __read_only(2);
+int mknod(const char *, unsigned, uint64_t) libcesque __read_only(1);
 int nice(int) libcesque;
-int open(const char *, int, ...) libcesque;
-int openat(int, const char *, int, ...) libcesque;
+int open(const char *, int, ...) libcesque __read_only(1);
+int openat(int, const char *, int, ...) libcesque __read_only(2);
 int pause(void) libcesque;
-int pipe(int[hasatleast 2]) libcesque;
-int pipe2(int[hasatleast 2], int) libcesque;
+int pipe(int[2]) libcesque __write_only(1);
+int pipe2(int[2], int) libcesque __write_only(1);
 int posix_fadvise(int, int64_t, int64_t, int) libcesque;
-int posix_madvise(void *, uint64_t, int) libcesque;
+int posix_madvise(void *, uint64_t, int) libcesque __read_write(1);
 int raise(int) libcesque;
 int reboot(int) libcesque;
-int remove(const char *) libcesque;
-int rename(const char *, const char *) libcesque;
-int renameat(int, const char *, int, const char *) libcesque;
-int rmdir(const char *) libcesque;
+int remove(const char *) libcesque __read_only(1);
+int rename(const char *, const char *) libcesque __read_only(1) __read_only(2);
+int renameat(int, const char *, int, const char *) libcesque __read_only(2) __read_only(4);
+int rmdir(const char *) libcesque __read_only(1);
 int sched_yield(void) libcesque;
 int setegid(unsigned) libcesque;
 int seteuid(unsigned) libcesque;
 int setfsgid(unsigned) libcesque;
 int setfsuid(unsigned) libcesque;
 int setgid(unsigned) libcesque;
-int setgroups(size_t, const unsigned[]) libcesque;
+int setgroups(size_t, const unsigned[]) libcesque __read_only(2);
 int setpgid(int, int) libcesque;
 int setpgrp(void) libcesque;
 int setpriority(int, unsigned, int) libcesque;
@@ -157,32 +158,32 @@ int setregid(unsigned, unsigned) libcesque;
 int setreuid(unsigned, unsigned) libcesque;
 int setsid(void) libcesque;
 int setuid(unsigned) libcesque;
-int shm_open(const char *, int, unsigned) libcesque;
-int shm_unlink(const char *) libcesque;
+int shm_open(const char *, int, unsigned) libcesque __read_only(1);
+int shm_unlink(const char *) libcesque __read_only(1);
 int sigignore(int) libcesque;
 int siginterrupt(int, int) libcesque;
-int symlink(const char *, const char *) libcesque;
-int symlinkat(const char *, int, const char *) libcesque;
+int symlink(const char *, const char *) libcesque __read_only(1) __read_only(2);
+int symlinkat(const char *, int, const char *) libcesque __read_only(1) __read_only(3);
 int tcgetpgrp(int) libcesque;
 int tcsetpgrp(int, int) libcesque;
-int truncate(const char *, int64_t) libcesque;
-int ttyname_r(int, char *, size_t) libcesque;
-int unlink(const char *) libcesque;
-int unlinkat(int, const char *, int) libcesque;
+int truncate(const char *, int64_t) libcesque __read_only(1);
+int ttyname_r(int, char *, size_t) libcesque __write_only(2, 3);
+int unlink(const char *) libcesque __read_only(1);
+int unlinkat(int, const char *, int) libcesque __read_only(2);
 int usleep(uint64_t) libcesque;
 int vfork(void) libcesque returnstwice;
-int wait(int *) libcesque;
-int waitpid(int, int *, int) libcesque;
+int wait(int *) libcesque __write_only(1);
+int waitpid(int, int *, int) libcesque __write_only(2);
 int64_t clock(void) libcesque;
-int64_t time(int64_t *) libcesque;
-ssize_t copy_file_range(int, long *, int, long *, size_t, unsigned) libcesque;
+int64_t time(int64_t *) libcesque __write_only(1);
+ssize_t copy_file_range(int, long *, int, long *, size_t, unsigned) libcesque __read_write(2) __read_write(4);
 ssize_t lseek(int, int64_t, int) libcesque;
-ssize_t pread(int, void *, size_t, int64_t) libcesque;
-ssize_t pwrite(int, const void *, size_t, int64_t) libcesque;
-ssize_t read(int, void *, size_t) libcesque;
-ssize_t readlink(const char *, char *, size_t) libcesque;
-ssize_t readlinkat(int, const char *, char *, size_t) libcesque;
-ssize_t write(int, const void *, size_t) libcesque;
+ssize_t pread(int, void *, size_t, int64_t) libcesque __write_only(2, 3);
+ssize_t pwrite(int, const void *, size_t, int64_t) libcesque __read_only(2);
+ssize_t read(int, void *, size_t) libcesque __write_only(2, 3);
+ssize_t readlink(const char *, char *, size_t) libcesque __read_only(1) __write_only(2, 3);
+ssize_t readlinkat(int, const char *, char *, size_t) libcesque __read_only(2) __write_only(3, 4);
+ssize_t write(int, const void *, size_t) libcesque __read_only(2);
 unsigned alarm(unsigned) libcesque;
 unsigned getegid(void) libcesque nosideeffect;
 unsigned geteuid(void) libcesque nosideeffect;
@@ -199,50 +200,50 @@ int prctl(int, ...) libcesque;
 int gettid(void) libcesque;
 int setresgid(unsigned, unsigned, unsigned) libcesque;
 int setresuid(unsigned, unsigned, unsigned) libcesque;
-int getresgid(unsigned *, unsigned *, unsigned *) libcesque;
-int getresuid(unsigned *, unsigned *, unsigned *) libcesque;
+int getresgid(unsigned *, unsigned *, unsigned *) libcesque __write_only(1) __write_only(2) __write_only(3);
+int getresuid(unsigned *, unsigned *, unsigned *) libcesque __write_only(1) __write_only(2) __write_only(3);
 char *get_current_dir_name(void) libcesque __wur;
-ssize_t splice(int, int64_t *, int, int64_t *, size_t, unsigned) libcesque;
-int memfd_create(const char *, unsigned int) libcesque;
-int execvpe(const char *, char *const[], char *const[]) libcesque;
-int euidaccess(const char *, int) libcesque;
-int eaccess(const char *, int) libcesque;
-int madvise(void *, uint64_t, int) libcesque;
-int getcpu(unsigned *, unsigned *) libcesque;
+ssize_t splice(int, int64_t *, int, int64_t *, size_t, unsigned) libcesque __read_write(2) __read_write(4);
+int memfd_create(const char *, unsigned int) libcesque __read_only(1);
+int execvpe(const char *, char *const[], char *const[]) libcesque __read_only(1) __read_only(2) __read_only(3);
+int euidaccess(const char *, int) libcesque __read_only(1);
+int eaccess(const char *, int) libcesque __read_only(1);
+int madvise(void *, uint64_t, int) libcesque __read_write(1);
+int getcpu(unsigned *, unsigned *) libcesque __write_only(1) __write_only(2);
 #endif
 
 #ifdef _COSMO_SOURCE
 bool32 fdexists(int) libcesque;
-bool32 fileexists(const char *) libcesque;
+bool32 fileexists(const char *) libcesque __read_only(1);
 bool32 ischardev(int) libcesque;
-bool32 isdirectory(const char *) libcesque;
-bool32 isexecutable(const char *) libcesque;
-bool32 isregularfile(const char *) libcesque;
-bool32 issymlink(const char *) libcesque;
-char *commandv(const char *, char *, size_t) libcesque;
-int __getcwd(char *, size_t) libcesque;
+bool32 isdirectory(const char *) libcesque __read_only(1);
+bool32 isexecutable(const char *) libcesque __read_only(1);
+bool32 isregularfile(const char *) libcesque __read_only(1);
+bool32 issymlink(const char *) libcesque __read_only(1);
+char *commandv(const char *, char *, size_t) libcesque __read_only(1) __write_only(2, 3);
+int __getcwd(char *, size_t) libcesque __write_only(1, 2);
 int clone(void *, void *, size_t, int, void *, void *, void *, void *);
 int fadvise(int, uint64_t, uint64_t, int) libcesque;
-int makedirs(const char *, unsigned) libcesque;
-int pivot_root(const char *, const char *) libcesque;
-int pledge(const char *, const char *) libcesque;
-int seccomp(unsigned, unsigned, void *) libcesque;
+int makedirs(const char *, unsigned) libcesque __read_only(1);
+int pivot_root(const char *, const char *) libcesque __read_only(1) __read_only(2);
+int pledge(const char *, const char *) libcesque __read_only(1) __read_only(2);
+int seccomp(unsigned, unsigned, void *) libcesque __read_only(3);
 int sys_iopl(int) libcesque;
 int sys_ioprio_get(int, int) libcesque;
 int sys_ioprio_set(int, int, int) libcesque;
-int sys_mlock(const void *, size_t) libcesque;
-int sys_mlock2(const void *, size_t, int) libcesque;
+int sys_mlock(const void *, size_t) libcesque __read_only(1);
+int sys_mlock2(const void *, size_t, int) libcesque __read_only(1);
 int sys_mlockall(int) libcesque;
-int sys_munlock(const void *, size_t) libcesque;
+int sys_munlock(const void *, size_t) libcesque __read_only(1);
 int sys_munlockall(void) libcesque;
 int sys_personality(uint64_t) libcesque;
 int sys_ptrace(int, ...) libcesque;
-int sysctl(int *, unsigned, void *, size_t *, void *, size_t) libcesque;
-int sysctlbyname(const char *, void *, size_t *, void *, size_t) libcesque;
-int sysctlnametomib(const char *, int *, size_t *) libcesque;
+int sysctl(int *, unsigned, void *, size_t *, void *, size_t) libcesque __read_write(1) __read_write(4) __read_write(5);
+int sysctlbyname(const char *, void *, size_t *, void *, size_t) libcesque __read_only(1) __write_only(2) __read_write(3) __read_only(4);
+int sysctlnametomib(const char *, int *, size_t *) libcesque __read_only(1) __write_only(2) __read_write(3);
 int tmpfd(void) libcesque;
-int touch(const char *, unsigned) libcesque;
-int unveil(const char *, const char *) libcesque;
+int touch(const char *, unsigned) libcesque __read_only(1);
+int unveil(const char *, const char *) libcesque __read_only(1);
 long ptrace(int, ...) libcesque;
 ssize_t copyfd(int, int, size_t) libcesque;
 ssize_t readansi(int, char *, size_t) libcesque;

libc/calls/ioctl.c

@@ -18,13 +18,13 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/assert.h"
 #include "libc/calls/internal.h"
-#include "libc/intrin/fds.h"
 #include "libc/calls/syscall-sysv.internal.h"
 #include "libc/calls/syscall_support-nt.internal.h"
 #include "libc/calls/termios.h"
 #include "libc/dce.h"
 #include "libc/errno.h"
 #include "libc/intrin/cmpxchg.h"
+#include "libc/intrin/fds.h"
 #include "libc/intrin/strace.h"
 #include "libc/intrin/weaken.h"
 #include "libc/macros.internal.h"
@@ -258,7 +258,10 @@ static textwindows struct HostAdapterInfoNode *appendHostInfo(
     node->flags = flags;
   } else {
     /* Copy from previous node */
-    node->flags = parentInfoNode->flags;
+    if (parentInfoNode)
+      node->flags = parentInfoNode->flags;
+    else
+      node->flags = 0;
   }
 
   ip = ntohl(
@@ -508,6 +511,7 @@ static int ioctl_siocgifconf_sysv(int fd, struct ifconf *ifc) {
   }
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
   bufMax = 15000; /* conservative guesstimate */
   b = alloca(bufMax);
   CheckLargeStackAllocation(b, bufMax);

libc/calls/mkntenvblock.c

@@ -144,6 +144,7 @@ textwindows int mkntenvblock(char16_t envblock[32767], char *const envp[],
   n = (CountStrings(envp) + CountStrings(extravars) + 1) * sizeof(char *);
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
   env.var = alloca(n);
   CheckLargeStackAllocation(env.var, n);
 #pragma GCC pop_options

libc/calls/pipe.c

@@ -33,7 +33,7 @@
  * @asyncsignalsafe
  * @see pipe2()
  */
-int pipe(int pipefd[hasatleast 2]) {
+int pipe(int pipefd[2]) {
   int rc;
   if (!pipefd) {
     // needed for windows which is polyfilled

libc/calls/pipe2.c

@@ -39,7 +39,7 @@
  * @param flags can have O_CLOEXEC or O_DIRECT or O_NONBLOCK
  * @return 0 on success, or -1 w/ errno and pipefd isn't modified
  */
-int pipe2(int pipefd[hasatleast 2], int flags) {
+int pipe2(int pipefd[2], int flags) {
   int rc;
   if (flags & ~(O_CLOEXEC | O_NONBLOCK | (O_DIRECT != -1u ? O_DIRECT : 0))) {
     return einval();

libc/calls/preadv.c

@@ -60,6 +60,7 @@ static ssize_t Preadv(int fd, struct iovec *iov, int iovlen, int64_t off) {
       struct iovec *iov2;
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
       iov2 = alloca(iovlen * sizeof(struct iovec));
       CheckLargeStackAllocation(iov2, iovlen * sizeof(struct iovec));
 #pragma GCC pop_options

libc/calls/pwritev.c

@@ -62,6 +62,7 @@ static ssize_t Pwritev(int fd, const struct iovec *iov, int iovlen,
       struct iovec *iov2;
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
       iov2 = alloca(iovlen * sizeof(struct iovec));
       CheckLargeStackAllocation(iov2, iovlen * sizeof(struct iovec));
 #pragma GCC pop_options

libc/calls/readlinkat-nt.c

@@ -52,6 +52,7 @@ static textwindows ssize_t sys_readlinkat_nt_impl(int dirfd, const char *path,
   ssize_t rc;
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
   uint32_t mem = 6000;
   volatile char *memory = alloca(mem);
   CheckLargeStackAllocation((char *)memory, mem);

libc/calls/readv.c

@@ -57,6 +57,7 @@ static ssize_t readv_impl(int fd, const struct iovec *iov, int iovlen) {
       struct iovec *iov2;
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
       iov2 = alloca(iovlen * sizeof(struct iovec));
       CheckLargeStackAllocation(iov2, iovlen * sizeof(struct iovec));
 #pragma GCC pop_options

libc/calls/sig.c

@@ -96,9 +96,8 @@ static textwindows int __sig_getter(atomic_ulong *sigs, sigset_t masked) {
     if ((deliverable = pending & ~masked)) {
       sig = bsfl(deliverable) + 1;
       bit = 1ull << (sig - 1);
-      if (atomic_fetch_and_explicit(sigs, ~bit, memory_order_acq_rel) & bit) {
+      if (atomic_fetch_and_explicit(sigs, ~bit, memory_order_acq_rel) & bit)
         return sig;
-      }
     } else {
       return 0;
     }
@@ -107,28 +106,23 @@ static textwindows int __sig_getter(atomic_ulong *sigs, sigset_t masked) {
 
 textwindows int __sig_get(sigset_t masked) {
   int sig;
-  if (!(sig = __sig_getter(&__get_tls()->tib_sigpending, masked))) {
+  if (!(sig = __sig_getter(&__get_tls()->tib_sigpending, masked)))
     sig = __sig_getter(&__sig.pending, masked);
-  }
   return sig;
 }
 
 static textwindows bool __sig_should_use_altstack(unsigned flags,
                                                   struct CosmoTib *tib) {
-  if (!(flags & SA_ONSTACK)) {
+  if (!(flags & SA_ONSTACK))
     return false;  // signal handler didn't enable it
-  }
-  if (!tib->tib_sigstack_size) {
+  if (!tib->tib_sigstack_size)
     return false;  // sigaltstack() wasn't installed on this thread
-  }
-  if (tib->tib_sigstack_flags & SS_DISABLE) {
+  if (tib->tib_sigstack_flags & SS_DISABLE)
     return false;  // sigaltstack() on this thread was disabled by user
-  }
   char *bp = __builtin_frame_address(0);
   if (tib->tib_sigstack_addr <= bp &&
-      bp <= tib->tib_sigstack_addr + tib->tib_sigstack_size) {
+      bp <= tib->tib_sigstack_addr + tib->tib_sigstack_size)
     return false;  // we're already on the alternate stack
-  }
   return true;
 }
 
@@ -282,9 +276,8 @@ static textwindows wontreturn void __sig_tramp(struct SignalFrame *sf) {
 
     // jump back into original code if there aren't any pending signals
     do {
-      if (!(sig = __sig_get(sf->ctx.uc_sigmask))) {
+      if (!(sig = __sig_get(sf->ctx.uc_sigmask)))
         __sig_restore(&sf->ctx);
-      }
     } while (!__sig_start(pt, sig, &sf->rva, &sf->flags));
 
     // tail recurse into another signal handler
@@ -459,11 +452,9 @@ textwindows void __sig_generate(int sig, int sic) {
 
 static textwindows char *__sig_stpcpy(char *d, const char *s) {
   size_t i;
-  for (i = 0;; ++i) {
-    if (!(d[i] = s[i])) {
+  for (i = 0;; ++i)
+    if (!(d[i] = s[i]))
       return d + i;
-    }
-  }
 }
 
 static textwindows wontreturn void __sig_death(int sig, const char *thing) {
@@ -500,9 +491,8 @@ static textwindows void __sig_unmaskable(struct NtExceptionPointers *ep,
   // if the user didn't install a signal handler for this unmaskable
   // exception, then print a friendly helpful hint message to stderr
   unsigned rva = __sighandrvas[sig];
-  if (rva == (intptr_t)SIG_DFL || rva == (intptr_t)SIG_IGN) {
+  if (rva == (intptr_t)SIG_DFL || rva == (intptr_t)SIG_IGN)
     __sig_death(sig, "uncaught ");
-  }
 
   // if this signal handler is configured to auto-reset to the default
   // then that reset needs to happen before the user handler is called
@@ -560,9 +550,8 @@ __msabi dontinstrument unsigned __sig_crash(struct NtExceptionPointers *ep) {
   // this behavior is consistent with how unix kernels are implemented
   if (sig == SIGTRAP) {
     ep->ContextRecord->Rip++;
-    if (__sig_ignored(sig)) {
+    if (__sig_ignored(sig))
       return kNtExceptionContinueExecution;
-    }
   }
 
   // win32 stack overflow detection executes INSIDE the guard page

libc/calls/statfs.c

@@ -34,6 +34,63 @@
 /**
  * Returns information about filesystem.
  *
+ * The `struct statfs` returned has the following fields:
+ *
+ * - `f_fstypename` holds a NUL-terminated string identifying the file
+ *   system type. On Linux, this will usually be "nfs". On FreeBSD, it
+ *   will usually be "zfs". On OpenBSD and NetBSD, it's usually "ffs".
+ *   On MacOS it's usually "apfs", and on Windows it's usually "NTFS".
+ *
+ * - `f_bsize` is the optimal transfer block size. This may be used to
+ *   appropriately chunk your i/o operations. On local file systems it
+ *   will usually be somewhere between 4096 and 131072 bytes. With NFS
+ *   it may be as high as 512kb.
+ *
+ * - `f_frsize` is the fragment size of the file system. This could be
+ *   anywhere between 512 and 4096 bytes for local filesystems usually
+ *   although it could go higher. It should less than, or equal to the
+ *   `f_bsize`. This fragment size is what you want to use to multiply
+ *   other fields that count blocks into a byte count.
+ *
+ * - `f_bfree` is the number of free blocks in the filesystem. You can
+ *   multiply this number by `f_frsize` to obtain the free byte count.
+ *
+ * - `f_bavail` is the number of free blocks in the filesystem you can
+ *   access from userspace. It's less than or equal to `f_bfree` which
+ *   generally has some blocks reserved for root in a pinch. You could
+ *   multiply this by `f_frsize` to convert this number to bytes.
+ *
+ * - `f_files` is the total number of file nodes. Not every OS has it.
+ *   On Windows for instance it's currently always `INT64_MAX`. It has
+ *   an unspecified meaning. It should be seen as informative.
+ *
+ * - `f_fsid` is an opaque data structure that uniquely identifies the
+ *   filesystem. We're not yet certain how reliable this is across the
+ *   various OSes and filesystem types.
+ *
+ * - `f_namelen` is basically the same as `NAME_MAX` which seems to be
+ *   255 on all the OSes we've evaluated. It's the maximum length when
+ *   it comes to individual components in a filesystem path.
+ *
+ * - `f_type` is an OS-specific file system type ID. This is just some
+ *   magic number. No defines are provided by Cosmopolitan Libc for it
+ *
+ * - `f_flags` specifies the options used when a filesystem is mounted
+ *   and the numbers vary across OSes. Cosmopolitan Libc polyfills the
+ *   magic numbers somewhat consistently. If `IsWindows()` is set then
+ *   the constants defined by Microsoft (e.g. `FILE_READ_ONLY_VOLUME`)
+ *   should be used. Otherwise on any other UNIX system, the following
+ *   constants are provided. You should check each constant at runtime
+ *   before using them, to determine if they're non-zero, for support.
+ *
+ *   - `ST_RDONLY` if mounted in read-only mode (works UNIX + Windows)
+ *   - `ST_NOSUID` if setuid binaries are forbidden (all UNIX support)
+ *   - `ST_NODEV` when device file access forbidden (all UNIX support)
+ *   - `ST_NOEXEC` when a file executions forbidden (all UNIX support)
+ *   - `ST_SYNCHRONOUS`, if `O_SYNC` always happens (all UNIX support)
+ *   - `ST_NOATIME` if access timestamps aren't set (all UNIX support)
+ *   - `ST_RELATIME` if relative acces time is used (all UNIX support)
+ *
  * @return 0 on success, or -1 w/ errno
  * @raise ECANCELED if thread was cancelled in masked mode
  * @raise EINTR if signal was delivered

libc/calls/tcflush.c

@@ -17,7 +17,6 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/calls/internal.h"
-#include "libc/intrin/fds.h"
 #include "libc/calls/syscall-nt.internal.h"
 #include "libc/calls/syscall-sysv.internal.h"
 #include "libc/calls/syscall_support-nt.internal.h"
@@ -25,6 +24,7 @@
 #include "libc/dce.h"
 #include "libc/errno.h"
 #include "libc/fmt/itoa.h"
+#include "libc/intrin/fds.h"
 #include "libc/intrin/strace.h"
 #include "libc/mem/alloca.h"
 #include "libc/nt/comms.h"
@@ -52,6 +52,7 @@ static const char *DescribeFlush(char buf[12], int action) {
 }
 
 static dontinline textwindows int sys_tcflush_nt(int fd, int queue) {
+#ifdef __x86_64__
   if (!sys_isatty(fd)) {
     return -1;  // ebadf, enotty
   }
@@ -59,6 +60,9 @@ static dontinline textwindows int sys_tcflush_nt(int fd, int queue) {
     return 0;  // windows console output is never buffered
   }
   return FlushConsoleInputBytes();
+#else
+  return enosys();
+#endif
 }
 
 /**

libc/calls/tinyprint.c

@@ -62,6 +62,7 @@ ssize_t tinyprint(int fd, const char *s, ...) {
       buf[n++] = c;
       if (n == sizeof(buf)) {
         if (tinyflush(fd, buf, n, &toto)) {
+          va_end(va);
           return toto;
         }
         n = 0;

libc/calls/ucontext.h

@@ -168,8 +168,8 @@ struct ucontext {
 
 typedef struct ucontext ucontext_t;
 
-int getcontext(ucontext_t *) dontthrow;
-int setcontext(const ucontext_t *) dontthrow;
+int getcontext(ucontext_t *) dontthrow __read_write(1);
+int setcontext(const ucontext_t *) dontthrow __read_only(1);
 int swapcontext(ucontext_t *, const ucontext_t *) dontthrow returnstwice;
 void makecontext(ucontext_t *, void *, int, ...) dontthrow dontcallback;
 void __sig_restore(const ucontext_t *) wontreturn;

libc/calls/writev.c

@@ -57,6 +57,7 @@ static ssize_t writev_impl(int fd, const struct iovec *iov, int iovlen) {
       struct iovec *iov2;
 #pragma GCC push_options
 #pragma GCC diagnostic ignored "-Walloca-larger-than="
+#pragma GCC diagnostic ignored "-Wanalyzer-out-of-bounds"
       iov2 = alloca(iovlen * sizeof(struct iovec));
       CheckLargeStackAllocation(iov2, iovlen * sizeof(struct iovec));
 #pragma GCC pop_options

libc/cosmo.h

@@ -2,7 +2,13 @@
 #define COSMOPOLITAN_LIBC_COSMO_H_
 COSMOPOLITAN_C_START_
 
-errno_t cosmo_once(_Atomic(unsigned) *, void (*)(void)) libcesque;
+#ifndef __cplusplus
+#define _COSMO_ATOMIC(x) _Atomic(x)
+#else
+#define _COSMO_ATOMIC(x) x
+#endif
+
+errno_t cosmo_once(_COSMO_ATOMIC(unsigned) *, void (*)(void)) libcesque;
 int systemvpe(const char *, char *const[], char *const[]) libcesque;
 char *GetProgramExecutableName(void) libcesque;
 void unleaf(void) libcesque;

libc/dlopen/dlopen.c

@@ -557,7 +557,9 @@ static void *foreign_thunk_nt(void *func) {
   // movabs $tramp,%r10
   code[14] = 0x49;
   code[15] = 0xba;
+#ifdef __x86_64__
   WRITE64LE(code + 16, (uintptr_t)__sysv2nt14);
+#endif
   // jmp *%r10
   code[24] = 0x41;
   code[25] = 0xff;

libc/integral/c.inc

@@ -1,7 +1,3 @@
-#if __GNUC__ + 0 < 2
-#define __attribute__(x)
-#endif
-
 #ifndef __cplusplus
 #define COSMOPOLITAN_C_START_
 #define COSMOPOLITAN_C_END_
@@ -10,73 +6,16 @@
 #define COSMOPOLITAN_CXX_USING_
 #endif
 
-#ifndef __ia16__
-#define __far
-#endif
-
 #if !defined(__GNUC__) && __cplusplus + 0 >= 201103L
 #define typeof(x) decltype(x)
 #elif !defined(__GNUC__) && __STDC_VERSION__ + 0 < 201112
 #define typeof(x) __typeof(x)
 #endif
 
-#ifdef __cplusplus
-#if __cplusplus >= 201103L
-#define _Alignof(x) alignof(x)
-#endif /* C++11 */
-#else  /* __cplusplus */
-#if __STDC_VERSION__ + 0 < 201112
-#if __GNUC__ + _MSC_VER + 0
-#define _Alignof(x) __alignof(x)
-#else
-#define _Alignof(x) /* basically all it ever did lool */ sizeof(x)
-#endif /* GNU/MSVC/!ANSI */
-#endif /* C11 */
-#endif /* __cplusplus */
-
-#if !defined(__cplusplus) && !defined(inline) && __STDC_VERSION__ + 0 < 199901
-#if defined(__GNUC__) || defined(_MSC_VER)
-#define inline __inline
-#else
-#define inline
-#define __inline
-#endif
-#endif
-
 #ifdef __chibicc__
 #define __extension__
 #endif
 
-#if __STDC_VERSION__ + 0 < 201112
-#ifdef __GNUC__
-#define _Alignas(x) __attribute__((__aligned__(x)))
-#elif defined(_MSC_VER)
-#define _Alignas(x) __declspec(align(x))
-#endif
-#endif
-
-#ifdef _MSC_VER
-#define __builtin_unreachable() __assume(false)
-#elif !((__GNUC__ + 0) * 100 + (__GNUC_MINOR__ + 0) >= 405 || \
-        defined(__clang__) || defined(__INTEL_COMPILER) ||    \
-        __has_builtin(__builtin_unreachable))
-#define __builtin_unreachable() \
-  for (;;) {                    \
-  }
-#endif
-
-#if (!defined(__llvm__) && !__has_builtin(__builtin_assume))
-#define __builtin_assume(x)    \
-  do {                         \
-    if (!(x))                  \
-      __builtin_unreachable(); \
-  } while (0)
-#endif
-
-#if __STDC_VERSION__ + 0 < 201112
-#define _Atomic(t) volatile t
-#endif
-
 #ifdef __llvm__
 #define __gnu_printf__ __printf__
 #define __gnu_scanf__  __scanf__
@@ -325,16 +264,6 @@ typedef struct {
 #define hasatleast
 #endif
 
-#if __STDC_VERSION__ + 0 < 199901L && !defined(restrict)
-#if !defined(__cplusplus) && \
-    ((__GNUC__ + 0) * 100 + (__GNUC_MINOR__ + 0) >= 301 || defined(_MSC_VER))
-#define restrict __restrict__
-#else
-#define restrict
-#define __restrict
-#endif
-#endif
-
 #ifndef dontcallback
 #if (__has_attribute(__leaf__) || \
      (!defined(__llvm__) &&       \
@@ -438,6 +367,24 @@ typedef struct {
 
 #define offsetof(type, member) __builtin_offsetof(type, member)
 
+#if defined(__GNUC__) && __GNUC__ >= 10
+#define __read_only(...) __attribute__((__access__(__read_only__, __VA_ARGS__)))
+#define __write_only(...) \
+  __attribute__((__access__(__write_only__, __VA_ARGS__)))
+#define __read_write(...) \
+  __attribute__((__access__(__read_write__, __VA_ARGS__)))
+#else
+#define __read_only(...)
+#define __write_only(...)
+#define __read_write(...)
+#endif
+
+#if defined(__GNUC__) && __GNUC__ >= 13
+#define __fd_arg(N) __attribute__((__fd_arg__(N)))
+#else
+#define __fd_arg(N)
+#endif
+
 #ifdef _COSMO_SOURCE
 
 #ifndef dontinstrument
@@ -594,11 +541,8 @@ typedef struct {
 
 #ifdef __aarch64__
 /* raise sigill (not sigtrap) like x86 does */
-#define __builtin_trap()     \
-  do {                       \
-    __asm__("udf\t#0x666");  \
-    __builtin_unreachable(); \
-  } while (0)
+#define __builtin_trap() \
+  (({ __asm__("udf\t#0x666"); }), __builtin_unreachable())
 #endif
 
 #endif /* _COSMO_SOURCE */

libc/integral/normalize.inc

@@ -3,8 +3,8 @@
 #endif
 
 #define __COSMOPOLITAN_MAJOR__ 3
-#define __COSMOPOLITAN_MINOR__ 5
-#define __COSMOPOLITAN_PATCH__ 8
+#define __COSMOPOLITAN_MINOR__ 6
+#define __COSMOPOLITAN_PATCH__ 2
 #define __COSMOPOLITAN__                                                   \
   (100000000 * __COSMOPOLITAN_MAJOR__ + 1000000 * __COSMOPOLITAN_MINOR__ + \
    __COSMOPOLITAN_PATCH__)
@@ -83,10 +83,6 @@
 #define __BIGGEST_ALIGNMENT__ 16
 #endif
 
-#ifdef _COSMO_SOURCE
-#define _PAGESIZE 4096
-#endif
-
 #if defined(__LP64__) && !defined(__INT64_TYPE__)
 #include "libc/integral/lp64.inc"
 #elif defined(_MSC_VER) && !defined(__INT64_TYPE__)

libc/intrin/cp.c

@@ -18,6 +18,9 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/calls/blockcancel.internal.h"
 #include "libc/calls/cp.internal.h"
+#include "libc/intrin/describebacktrace.h"
+#include "libc/intrin/kprintf.h"
+#include "libc/nexgen32e/stackframe.h"
 #include "libc/runtime/internal.h"
 #include "libc/runtime/runtime.h"
 #include "libc/thread/posixthread.internal.h"
@@ -26,11 +29,9 @@
 
 int begin_cancelation_point(void) {
   int state = 0;
-  struct CosmoTib *tib;
-  struct PosixThread *pt;
   if (__tls_enabled) {
-    tib = __get_tls();
-    if ((pt = (struct PosixThread *)tib->tib_pthread)) {
+    struct PosixThread *pt;
+    if ((pt = _pthread_self())) {
       state = pt->pt_flags & PT_INCANCEL;
       pt->pt_flags |= PT_INCANCEL;
     }
@@ -39,18 +40,20 @@ int begin_cancelation_point(void) {
 }
 
 void end_cancelation_point(int state) {
-  struct CosmoTib *tib;
-  struct PosixThread *pt;
   if (__tls_enabled) {
-    tib = __get_tls();
-    if ((pt = (struct PosixThread *)tib->tib_pthread)) {
+    struct PosixThread *pt;
+    if ((pt = _pthread_self())) {
       pt->pt_flags &= ~PT_INCANCEL;
       pt->pt_flags |= state;
     }
   }
 }
 
-void report_cancelation_point(void) {
+void report_cancelation_point(int sysv_ordinal, int xnu_ordinal) {
+  char bt[160];
+  struct StackFrame *bp = __builtin_frame_address(0);
+  kprintf("error: report_cancelation_point(%#x, %#x) %s\n", sysv_ordinal,
+          xnu_ordinal, (DescribeBacktrace)(bt, bp));
   __builtin_trap();
 }
 

libc/intrin/describebacktrace.c

@@ -24,13 +24,13 @@
 
 #define N 160
 
-static bool IsDangerous(const void *ptr) {
+privileged static bool IsDangerous(const void *ptr) {
   if (_weaken(kisdangerous))
     return _weaken(kisdangerous)(ptr);
   return false;
 }
 
-static char *FormatHex(char *p, unsigned long x) {
+privileged static char *FormatHex(char *p, unsigned long x) {
   int k = x ? (__builtin_clzl(x) ^ 63) + 1 : 1;
   k = (k + 3) & -4;
   while (k > 0)
@@ -39,8 +39,8 @@ static char *FormatHex(char *p, unsigned long x) {
   return p;
 }
 
-dontinstrument const char *(DescribeBacktrace)(char buf[N],
-                                               const struct StackFrame *fr) {
+privileged dontinstrument const char *(
+    DescribeBacktrace)(char buf[N], const struct StackFrame *fr) {
   char *p = buf;
   char *pe = p + N;
   bool gotsome = false;

libc/intrin/iscall.c

@@ -20,7 +20,7 @@
 
 // returns true if `p` is preceded by x86 call instruction
 // this is actually impossible to do but we'll do our best
-dontinstrument int __is_call(const unsigned char *p) {
+privileged dontinstrument int __is_call(const unsigned char *p) {
   if (p[-5] == 0xe8)
     return 5;  // call Jvds
   if (p[-2] == 0xff && (p[-1] & 070) == 020)

libc/intrin/maps.c

@@ -18,13 +18,17 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/intrin/maps.h"
 #include "ape/sections.internal.h"
+#include "libc/calls/state.internal.h"
 #include "libc/dce.h"
+#include "libc/intrin/describebacktrace.h"
 #include "libc/intrin/dll.h"
+#include "libc/intrin/kprintf.h"
 #include "libc/intrin/maps.h"
 #include "libc/runtime/runtime.h"
 #include "libc/runtime/stack.h"
 #include "libc/sysv/consts/auxv.h"
 #include "libc/sysv/consts/prot.h"
+#include "libc/thread/lock.h"
 
 #ifdef __x86_64__
 __static_yoink("_init_maps");
@@ -85,37 +89,67 @@ void __maps_init(void) {
 }
 
 privileged bool __maps_lock(void) {
+  int me;
+  uint64_t word, lock;
   struct CosmoTib *tib;
   if (!__tls_enabled)
     return false;
-  tib = __get_tls_privileged();
-  if (atomic_fetch_add_explicit(&tib->tib_relock_maps, 1, memory_order_relaxed))
-    return true;
-  int backoff = 0;
-  while (atomic_exchange_explicit(&__maps.lock, 1, memory_order_acquire)) {
-    if (backoff < 7) {
-      volatile int i;
-      for (i = 0; i != 1 << backoff; i++) {
-      }
-      backoff++;
-    } else {
-      // STRACE("pthread_delay_np(__maps)");
-#if defined(__GNUC__) && defined(__aarch64__)
-      __asm__ volatile("yield");
-#elif defined(__GNUC__) && (defined(__x86_64__) || defined(__i386__))
-      __asm__ volatile("pause");
-#endif
+  if (!(tib = __get_tls_privileged()))
+    return false;
+  if (tib->tib_flags & TIB_FLAG_VFORKED)
+    return false;
+  me = atomic_load_explicit(&tib->tib_tid, memory_order_acquire);
+  if (me <= 0)
+    return false;
+  word = atomic_load_explicit(&__maps.lock, memory_order_relaxed);
+  for (;;) {
+    if (MUTEX_OWNER(word) == me) {
+      if (atomic_compare_exchange_weak_explicit(
+              &__maps.lock, &word, MUTEX_INC_DEPTH(word), memory_order_relaxed,
+              memory_order_relaxed))
+        return true;
+      continue;
+    }
+    word = 0;
+    lock = MUTEX_LOCK(word);
+    lock = MUTEX_SET_OWNER(lock, me);
+    if (atomic_compare_exchange_weak_explicit(&__maps.lock, &word, lock,
+                                              memory_order_acquire,
+                                              memory_order_relaxed))
+      return false;
+    for (;;) {
+      word = atomic_load_explicit(&__maps.lock, memory_order_relaxed);
+      if (MUTEX_OWNER(word) == me)
+        break;
+      if (!word)
+        break;
     }
   }
-  return false;
 }
 
 privileged void __maps_unlock(void) {
+  int me;
+  uint64_t word;
   struct CosmoTib *tib;
   if (!__tls_enabled)
     return;
-  tib = __get_tls_privileged();
-  if (atomic_fetch_sub_explicit(&tib->tib_relock_maps, 1,
-                                memory_order_relaxed) == 1)
-    atomic_store_explicit(&__maps.lock, 0, memory_order_release);
+  if (!(tib = __get_tls_privileged()))
+    return;
+  if (tib->tib_flags & TIB_FLAG_VFORKED)
+    return;
+  me = atomic_load_explicit(&tib->tib_tid, memory_order_acquire);
+  if (me <= 0)
+    return;
+  word = atomic_load_explicit(&__maps.lock, memory_order_relaxed);
+  for (;;) {
+    if (MUTEX_DEPTH(word)) {
+      if (atomic_compare_exchange_weak_explicit(
+              &__maps.lock, &word, MUTEX_DEC_DEPTH(word), memory_order_relaxed,
+              memory_order_relaxed))
+        break;
+    }
+    if (atomic_compare_exchange_weak_explicit(
+            &__maps.lock, &word, 0, memory_order_release, memory_order_relaxed))
+      break;
+  }
 }

libc/intrin/maps.h

@@ -6,6 +6,8 @@
 #include "libc/thread/tls2.internal.h"
 COSMOPOLITAN_C_START_
 
+#define MAPS_RETRY ((void *)-1)
+
 #define MAP_TREE_CONTAINER(e) TREE_CONTAINER(struct Map, tree, e)
 
 struct Map {
@@ -20,14 +22,14 @@ struct Map {
   intptr_t hand;     /* windows nt only */
   union {
     struct Tree tree;
-    struct Map *free;
+    struct Map *freed;
   };
 };
 
 struct Maps {
-  atomic_int lock;
   struct Tree *maps;
-  _Atomic(struct Map *) free;
+  _Atomic(uint64_t) lock;
+  _Atomic(struct Map *) freed;
   size_t count;
   size_t pages;
   _Atomic(char *) pick;

libc/intrin/mmap.c

@@ -44,7 +44,7 @@
 
 #define MMDEBUG   IsModeDbg()
 #define MAX_SIZE  0x0ff800000000ul
-#define MAX_TRIES 10
+#define MAX_TRIES 50
 
 #define MAP_FIXED_NOREPLACE_linux 0x100000
 
@@ -120,6 +120,7 @@ static int __muntrack(char *addr, size_t size, int pagesz,
   struct Map *map;
   struct Map *next;
   struct Map *floor;
+StartOver:
   floor = __maps_floor(addr);
   for (map = floor; map && map->addr <= addr + size; map = next) {
     next = __maps_next(map);
@@ -131,7 +132,7 @@ static int __muntrack(char *addr, size_t size, int pagesz,
     if (addr <= map_addr && addr + PGUP(size) >= map_addr + PGUP(map_size)) {
       // remove mapping completely
       tree_remove(&__maps.maps, &map->tree);
-      map->free = *deleted;
+      map->freed = *deleted;
       *deleted = map;
       __maps.pages -= (map_size + pagesz - 1) / pagesz;
       __maps.count -= 1;
@@ -148,6 +149,8 @@ static int __muntrack(char *addr, size_t size, int pagesz,
       ASSERT(left > 0);
       struct Map *leftmap;
       if ((leftmap = __maps_alloc())) {
+        if (leftmap == MAPS_RETRY)
+          goto StartOver;
         map->addr += left;
         map->size = right;
         if (!(map->flags & MAP_ANONYMOUS))
@@ -155,7 +158,7 @@ static int __muntrack(char *addr, size_t size, int pagesz,
         __maps.pages -= (left + pagesz - 1) / pagesz;
         leftmap->addr = map_addr;
         leftmap->size = left;
-        leftmap->free = *deleted;
+        leftmap->freed = *deleted;
         *deleted = leftmap;
         __maps_check();
       } else {
@@ -167,11 +170,13 @@ static int __muntrack(char *addr, size_t size, int pagesz,
       size_t right = map_addr + map_size - addr;
       struct Map *rightmap;
       if ((rightmap = __maps_alloc())) {
+        if (rightmap == MAPS_RETRY)
+          goto StartOver;
         map->size = left;
         __maps.pages -= (right + pagesz - 1) / pagesz;
         rightmap->addr = addr;
         rightmap->size = right;
-        rightmap->free = *deleted;
+        rightmap->freed = *deleted;
         *deleted = rightmap;
         __maps_check();
       } else {
@@ -184,8 +189,14 @@ static int __muntrack(char *addr, size_t size, int pagesz,
       size_t right = map_size - middle - left;
       struct Map *leftmap;
       if ((leftmap = __maps_alloc())) {
+        if (leftmap == MAPS_RETRY)
+          goto StartOver;
         struct Map *middlemap;
         if ((middlemap = __maps_alloc())) {
+          if (middlemap == MAPS_RETRY) {
+            __maps_free(leftmap);
+            goto StartOver;
+          }
           leftmap->addr = map_addr;
           leftmap->size = left;
           leftmap->off = map->off;
@@ -200,10 +211,11 @@ static int __muntrack(char *addr, size_t size, int pagesz,
           __maps.count += 1;
           middlemap->addr = addr;
           middlemap->size = size;
-          middlemap->free = *deleted;
+          middlemap->freed = *deleted;
           *deleted = middlemap;
           __maps_check();
         } else {
+          __maps_free(leftmap);
           rc = -1;
         }
       } else {
@@ -217,9 +229,9 @@ static int __muntrack(char *addr, size_t size, int pagesz,
 void __maps_free(struct Map *map) {
   map->size = 0;
   map->addr = MAP_FAILED;
-  map->free = atomic_load_explicit(&__maps.free, memory_order_relaxed);
+  map->freed = atomic_load_explicit(&__maps.freed, memory_order_relaxed);
   for (;;) {
-    if (atomic_compare_exchange_weak_explicit(&__maps.free, &map->free, map,
+    if (atomic_compare_exchange_weak_explicit(&__maps.freed, &map->freed, map,
                                               memory_order_release,
                                               memory_order_relaxed))
       break;
@@ -229,7 +241,7 @@ void __maps_free(struct Map *map) {
 static void __maps_free_all(struct Map *list) {
   struct Map *next;
   for (struct Map *map = list; map; map = next) {
-    next = map->free;
+    next = map->freed;
     __maps_free(map);
   }
 }
@@ -285,9 +297,9 @@ static void __maps_insert(struct Map *map) {
 
 struct Map *__maps_alloc(void) {
   struct Map *map;
-  map = atomic_load_explicit(&__maps.free, memory_order_relaxed);
+  map = atomic_load_explicit(&__maps.freed, memory_order_relaxed);
   while (map) {
-    if (atomic_compare_exchange_weak_explicit(&__maps.free, &map, map->free,
+    if (atomic_compare_exchange_weak_explicit(&__maps.freed, &map, map->freed,
                                               memory_order_acquire,
                                               memory_order_relaxed))
       return map;
@@ -304,12 +316,11 @@ struct Map *__maps_alloc(void) {
   map->flags = MAP_PRIVATE | MAP_ANONYMOUS | MAP_NOFORK;
   map->hand = sys.maphandle;
   __maps_lock();
-  __maps_insert(map++);
+  __maps_insert(map);
   __maps_unlock();
-  map->addr = MAP_FAILED;
-  for (int i = 1; i < gransz / sizeof(struct Map) - 1; ++i)
+  for (int i = 1; i < gransz / sizeof(struct Map); ++i)
     __maps_free(map + i);
-  return map;
+  return MAPS_RETRY;
 }
 
 static int __munmap(char *addr, size_t size) {
@@ -346,7 +357,7 @@ static int __munmap(char *addr, size_t size) {
 
   // delete mappings
   int rc = 0;
-  for (struct Map *map = deleted; map; map = map->free) {
+  for (struct Map *map = deleted; map; map = map->freed) {
     if (!IsWindows()) {
       if (sys_munmap(map->addr, map->size))
         rc = -1;
@@ -359,7 +370,7 @@ static int __munmap(char *addr, size_t size) {
     }
   }
 
-  // free mappings
+  // freed mappings
   __maps_free_all(deleted);
 
   return rc;
@@ -368,7 +379,7 @@ static int __munmap(char *addr, size_t size) {
 void *__maps_randaddr(void) {
   uintptr_t addr;
   addr = _rand64();
-  addr &= 0x007fffffffff;
+  addr &= 0x3fffffffffff;
   addr |= 0x004000000000;
   addr &= -__gransize;
   return (void *)addr;
@@ -396,21 +407,32 @@ void *__maps_pickaddr(size_t size) {
 static void *__mmap_chunk(void *addr, size_t size, int prot, int flags, int fd,
                           int64_t off, int pagesz, int gransz) {
 
+  // allocate Map object
+  struct Map *map;
+  do {
+    if (!(map = __maps_alloc()))
+      return MAP_FAILED;
+  } while (map == MAPS_RETRY);
+
   // polyfill nuances of fixed mappings
   int sysflags = flags;
   bool noreplace = false;
   bool should_untrack = false;
   if (flags & MAP_FIXED_NOREPLACE) {
-    if (flags & MAP_FIXED)
+    if (flags & MAP_FIXED) {
+      __maps_free(map);
       return (void *)einval();
+    }
     sysflags &= ~MAP_FIXED_NOREPLACE;
     if (IsLinux()) {
       noreplace = true;
       sysflags |= MAP_FIXED_NOREPLACE_linux;
     } else if (IsFreebsd() || IsNetbsd()) {
       sysflags |= MAP_FIXED;
-      if (__maps_overlaps(addr, size, pagesz))
+      if (__maps_overlaps(addr, size, pagesz)) {
+        __maps_free(map);
         return (void *)eexist();
+      }
     } else {
       noreplace = true;
     }
@@ -418,11 +440,6 @@ static void *__mmap_chunk(void *addr, size_t size, int prot, int flags, int fd,
     should_untrack = true;
   }
 
-  // allocate Map object
-  struct Map *map;
-  if (!(map = __maps_alloc()))
-    return MAP_FAILED;
-
   // remove mapping we blew away
   if (IsWindows() && should_untrack)
     __munmap(addr, size);
@@ -451,7 +468,7 @@ TryAgain:
   }
 
   // polyfill map fixed noreplace
-  // we assume non-linux gives us addr if it's free
+  // we assume non-linux gives us addr if it's freed
   // that's what linux (e.g. rhel7) did before noreplace
   if (noreplace && res.addr != addr) {
     if (!IsWindows()) {
@@ -572,23 +589,27 @@ static void *__mremap_impl(char *old_addr, size_t old_size, size_t new_size,
         return (void *)einval();
   }
 
+  // allocate object for tracking new mapping
+  struct Map *map;
+  do {
+    if (!(map = __maps_alloc()))
+      return (void *)enomem();
+  } while (map == MAPS_RETRY);
+
   // check old interval is fully contained within one mapping
   struct Map *old_map;
   if (!(old_map = __maps_floor(old_addr)) ||
       old_addr + old_size > old_map->addr + PGUP(old_map->size) ||
-      old_addr < old_map->addr)
+      old_addr < old_map->addr) {
+    __maps_free(map);
     return (void *)efault();
+  }
 
   // save old properties
   int old_off = old_map->off;
   int old_prot = old_map->prot;
   int old_flags = old_map->flags;
 
-  // allocate object for tracking new mapping
-  struct Map *map;
-  if (!(map = __maps_alloc()))
-    return (void *)enomem();
-
   // netbsd mremap fixed returns enoent rather than unmapping old pages
   if (IsNetbsd() && (flags & MREMAP_FIXED))
     if (__munmap(new_addr, new_size)) {

libc/intrin/mprotect.c

@@ -75,6 +75,7 @@ int __mprotect(char *addr, size_t size, int prot) {
     return edeadlk();
   }
   struct Map *map, *floor;
+StartOver:
   floor = __maps_floor(addr);
   for (map = floor; map && map->addr <= addr + size; map = __maps_next(map)) {
     char *map_addr = map->addr;
@@ -93,10 +94,12 @@ int __mprotect(char *addr, size_t size, int prot) {
       }
     } else if (addr <= map_addr) {
       // change lefthand side of mapping
-      size_t left = PGUP(addr + size - map_addr);
+      size_t left = addr + size - map_addr;
       size_t right = map_size - left;
       struct Map *leftmap;
       if ((leftmap = __maps_alloc())) {
+        if (leftmap == MAPS_RETRY)
+          goto StartOver;
         if (!__mprotect_chunk(map_addr, left, prot, false)) {
           leftmap->addr = map_addr;
           leftmap->size = left;
@@ -127,6 +130,8 @@ int __mprotect(char *addr, size_t size, int prot) {
       size_t right = map_addr + map_size - addr;
       struct Map *leftmap;
       if ((leftmap = __maps_alloc())) {
+        if (leftmap == MAPS_RETRY)
+          goto StartOver;
         if (!__mprotect_chunk(map_addr + left, right, prot, false)) {
           leftmap->addr = map_addr;
           leftmap->size = left;
@@ -159,8 +164,14 @@ int __mprotect(char *addr, size_t size, int prot) {
       size_t right = map_size - middle - left;
       struct Map *leftmap;
       if ((leftmap = __maps_alloc())) {
+        if (leftmap == MAPS_RETRY)
+          goto StartOver;
         struct Map *midlmap;
         if ((midlmap = __maps_alloc())) {
+          if (midlmap == MAPS_RETRY) {
+            __maps_free(leftmap);
+            goto StartOver;
+          }
           if (!__mprotect_chunk(map_addr + left, middle, prot, false)) {
             leftmap->addr = map_addr;
             leftmap->size = left;

libc/intrin/pthread_mutex_destroy.c

@@ -22,8 +22,10 @@
 /**
  * Destroys mutex.
  *
+ * Destroying a mutex that's currently locked or being waited upon, will
+ * result in undefined behavior.
+ *
  * @return 0 on success, or error number on failure
- * @raise EINVAL if mutex is locked in our implementation
  */
 errno_t pthread_mutex_destroy(pthread_mutex_t *mutex) {
   memset(mutex, -1, sizeof(*mutex));

libc/intrin/pthread_mutex_lock.c

@@ -16,6 +16,7 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/calls/blockcancel.internal.h"
 #include "libc/calls/calls.h"
 #include "libc/calls/state.internal.h"
 #include "libc/dce.h"
@@ -27,39 +28,48 @@
 #include "libc/runtime/internal.h"
 #include "libc/thread/lock.h"
 #include "libc/thread/thread.h"
+#include "third_party/nsync/futex.internal.h"
 #include "third_party/nsync/mu.h"
 
-static errno_t pthread_mutex_lock_impl(pthread_mutex_t *mutex) {
-  int me;
+static void pthread_mutex_lock_spin(atomic_int *word) {
   int backoff = 0;
-  uint64_t word, lock;
-
-  // get current state of lock
-  word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
-
-  // use fancy nsync mutex if possible
-  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL &&        //
-      MUTEX_PSHARED(word) == PTHREAD_PROCESS_PRIVATE &&  //
-      _weaken(nsync_mu_lock)) {
-    _weaken(nsync_mu_lock)((nsync_mu *)mutex);
-    return 0;
-  }
-
-  // implement barebones normal mutexes
-  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL) {
+  for (;;) {
+    if (!atomic_exchange_explicit(word, 1, memory_order_acquire))
+      break;
     for (;;) {
-      word = MUTEX_UNLOCK(word);
-      lock = MUTEX_LOCK(word);
-      if (atomic_compare_exchange_weak_explicit(&mutex->_word, &word, lock,
-                                                memory_order_acquire,
-                                                memory_order_relaxed))
-        return 0;
-      backoff = pthread_delay_np(mutex, backoff);
+      if (!atomic_load_explicit(word, memory_order_relaxed))
+        break;
+      backoff = pthread_delay_np(word, backoff);
     }
   }
+}
 
-  // implement recursive mutexes
-  me = gettid();
+// see "take 3" algorithm in "futexes are tricky" by ulrich drepper
+// slightly improved to attempt acquiring multiple times b4 syscall
+static void pthread_mutex_lock_drepper(atomic_int *futex, char pshare) {
+  int word;
+  for (int i = 0; i < 4; ++i) {
+    word = 0;
+    if (atomic_compare_exchange_strong_explicit(
+            futex, &word, 1, memory_order_acquire, memory_order_acquire))
+      return;
+    pthread_pause_np();
+  }
+  if (word == 1)
+    word = atomic_exchange_explicit(futex, 2, memory_order_acquire);
+  while (word > 0) {
+    BLOCK_CANCELATION;
+    _weaken(nsync_futex_wait_)(futex, 2, pshare, 0);
+    ALLOW_CANCELATION;
+    word = atomic_exchange_explicit(futex, 2, memory_order_acquire);
+  }
+}
+
+static errno_t pthread_mutex_lock_recursive(pthread_mutex_t *mutex,
+                                            uint64_t word) {
+  uint64_t lock;
+  int backoff = 0;
+  int me = gettid();
   for (;;) {
     if (MUTEX_OWNER(word) == me) {
       if (MUTEX_TYPE(word) != PTHREAD_MUTEX_ERRORCHECK) {
@@ -85,10 +95,47 @@ static errno_t pthread_mutex_lock_impl(pthread_mutex_t *mutex) {
       mutex->_pid = __pid;
       return 0;
     }
-    backoff = pthread_delay_np(mutex, backoff);
+    for (;;) {
+      word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
+      if (MUTEX_OWNER(word) == me)
+        break;
+      if (word == MUTEX_UNLOCK(word))
+        break;
+      backoff = pthread_delay_np(mutex, backoff);
+    }
   }
 }
 
+static errno_t pthread_mutex_lock_impl(pthread_mutex_t *mutex) {
+  uint64_t word;
+
+  // get current state of lock
+  word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
+
+#if PTHREAD_USE_NSYNC
+  // use superior mutexes if possible
+  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL &&        //
+      MUTEX_PSHARED(word) == PTHREAD_PROCESS_PRIVATE &&  //
+      _weaken(nsync_mu_lock)) {
+    _weaken(nsync_mu_lock)((nsync_mu *)mutex);
+    return 0;
+  }
+#endif
+
+  // handle normal mutexes
+  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL) {
+    if (_weaken(nsync_futex_wait_)) {
+      pthread_mutex_lock_drepper(&mutex->_futex, MUTEX_PSHARED(word));
+    } else {
+      pthread_mutex_lock_spin(&mutex->_futex);
+    }
+    return 0;
+  }
+
+  // handle recursive and error checking mutexes
+  return pthread_mutex_lock_recursive(mutex, word);
+}
+
 /**
  * Locks mutex.
  *

libc/intrin/pthread_mutex_trylock.c

@@ -24,52 +24,27 @@
 #include "libc/runtime/internal.h"
 #include "libc/thread/lock.h"
 #include "libc/thread/thread.h"
+#include "third_party/nsync/futex.internal.h"
 #include "third_party/nsync/mu.h"
 
-/**
- * Attempts acquiring lock.
- *
- * Unlike pthread_mutex_lock() this function won't block and instead
- * returns an error immediately if the lock couldn't be acquired.
- *
- * @return 0 if lock was acquired, otherwise an errno
- * @raise EAGAIN if maximum number of recursive locks is held
- * @raise EBUSY if lock is currently held in read or write mode
- * @raise EINVAL if `mutex` doesn't refer to an initialized lock
- * @raise EDEADLK if `mutex` is `PTHREAD_MUTEX_ERRORCHECK` and the
- *     current thread already holds this mutex
- */
-errno_t pthread_mutex_trylock(pthread_mutex_t *mutex) {
-  int me;
-  uint64_t word, lock;
+static errno_t pthread_mutex_trylock_spin(atomic_int *word) {
+  if (!atomic_exchange_explicit(word, 1, memory_order_acquire))
+    return 0;
+  return EBUSY;
+}
 
-  // get current state of lock
-  word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
+static errno_t pthread_mutex_trylock_drepper(atomic_int *futex) {
+  int word = 0;
+  if (atomic_compare_exchange_strong_explicit(
+          futex, &word, 1, memory_order_acquire, memory_order_acquire))
+    return 0;
+  return EBUSY;
+}
 
-  // delegate to *NSYNC if possible
-  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL &&
-      MUTEX_PSHARED(word) == PTHREAD_PROCESS_PRIVATE &&  //
-      _weaken(nsync_mu_trylock)) {
-    if (_weaken(nsync_mu_trylock)((nsync_mu *)mutex)) {
-      return 0;
-    } else {
-      return EBUSY;
-    }
-  }
-
-  // handle normal mutexes
-  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL) {
-    word = MUTEX_UNLOCK(word);
-    lock = MUTEX_LOCK(word);
-    if (atomic_compare_exchange_weak_explicit(&mutex->_word, &word, lock,
-                                              memory_order_acquire,
-                                              memory_order_relaxed))
-      return 0;
-    return EBUSY;
-  }
-
-  // handle recursive and error check mutexes
-  me = gettid();
+static errno_t pthread_mutex_trylock_recursive(pthread_mutex_t *mutex,
+                                               uint64_t word) {
+  uint64_t lock;
+  int me = gettid();
   for (;;) {
     if (MUTEX_OWNER(word) == me) {
       if (MUTEX_TYPE(word) != PTHREAD_MUTEX_ERRORCHECK) {
@@ -98,3 +73,47 @@ errno_t pthread_mutex_trylock(pthread_mutex_t *mutex) {
     return EBUSY;
   }
 }
+
+/**
+ * Attempts acquiring lock.
+ *
+ * Unlike pthread_mutex_lock() this function won't block and instead
+ * returns an error immediately if the lock couldn't be acquired.
+ *
+ * @return 0 if lock was acquired, otherwise an errno
+ * @raise EAGAIN if maximum number of recursive locks is held
+ * @raise EBUSY if lock is currently held in read or write mode
+ * @raise EINVAL if `mutex` doesn't refer to an initialized lock
+ * @raise EDEADLK if `mutex` is `PTHREAD_MUTEX_ERRORCHECK` and the
+ *     current thread already holds this mutex
+ */
+errno_t pthread_mutex_trylock(pthread_mutex_t *mutex) {
+
+  // get current state of lock
+  uint64_t word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
+
+#if PTHREAD_USE_NSYNC
+  // use superior mutexes if possible
+  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL &&
+      MUTEX_PSHARED(word) == PTHREAD_PROCESS_PRIVATE &&  //
+      _weaken(nsync_mu_trylock)) {
+    if (_weaken(nsync_mu_trylock)((nsync_mu *)mutex)) {
+      return 0;
+    } else {
+      return EBUSY;
+    }
+  }
+#endif
+
+  // handle normal mutexes
+  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL) {
+    if (_weaken(nsync_futex_wait_)) {
+      return pthread_mutex_trylock_drepper(&mutex->_futex);
+    } else {
+      return pthread_mutex_trylock_spin(&mutex->_futex);
+    }
+  }
+
+  // handle recursive and error checking mutexes
+  return pthread_mutex_trylock_recursive(mutex, word);
+}

libc/intrin/pthread_mutex_unlock.c

@@ -25,43 +25,25 @@
 #include "libc/runtime/internal.h"
 #include "libc/thread/lock.h"
 #include "libc/thread/thread.h"
+#include "third_party/nsync/futex.internal.h"
 #include "third_party/nsync/mu.h"
 
-/**
- * Releases mutex.
- *
- * This function does nothing in vfork() children.
- *
- * @return 0 on success or error number on failure
- * @raises EPERM if in error check mode and not owned by caller
- * @vforksafe
- */
-errno_t pthread_mutex_unlock(pthread_mutex_t *mutex) {
-  int me;
-  uint64_t word, lock;
+static void pthread_mutex_unlock_spin(atomic_int *word) {
+  atomic_store_explicit(word, 0, memory_order_release);
+}
 
-  LOCKTRACE("pthread_mutex_unlock(%t)", mutex);
-
-  // get current state of lock
-  word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
-
-  // use fancy nsync mutex if possible
-  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL &&        //
-      MUTEX_PSHARED(word) == PTHREAD_PROCESS_PRIVATE &&  //
-      _weaken(nsync_mu_unlock)) {
-    _weaken(nsync_mu_unlock)((nsync_mu *)mutex);
-    return 0;
+// see "take 3" algorithm in "futexes are tricky" by ulrich drepper
+static void pthread_mutex_unlock_drepper(atomic_int *futex, char pshare) {
+  int word = atomic_fetch_sub_explicit(futex, 1, memory_order_release);
+  if (word == 2) {
+    atomic_store_explicit(futex, 0, memory_order_release);
+    _weaken(nsync_futex_wake_)(futex, 1, pshare);
   }
+}
 
-  // implement barebones normal mutexes
-  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL) {
-    lock = MUTEX_UNLOCK(word);
-    atomic_store_explicit(&mutex->_word, lock, memory_order_release);
-    return 0;
-  }
-
-  // implement recursive mutex unlocking
-  me = gettid();
+static errno_t pthread_mutex_unlock_recursive(pthread_mutex_t *mutex,
+                                              uint64_t word) {
+  int me = gettid();
   for (;;) {
 
     // we allow unlocking an initialized lock that wasn't locked, but we
@@ -86,3 +68,44 @@ errno_t pthread_mutex_unlock(pthread_mutex_t *mutex) {
       return 0;
   }
 }
+
+/**
+ * Releases mutex.
+ *
+ * This function does nothing in vfork() children.
+ *
+ * @return 0 on success or error number on failure
+ * @raises EPERM if in error check mode and not owned by caller
+ * @vforksafe
+ */
+errno_t pthread_mutex_unlock(pthread_mutex_t *mutex) {
+  uint64_t word;
+
+  LOCKTRACE("pthread_mutex_unlock(%t)", mutex);
+
+  // get current state of lock
+  word = atomic_load_explicit(&mutex->_word, memory_order_relaxed);
+
+#if PTHREAD_USE_NSYNC
+  // use superior mutexes if possible
+  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL &&        //
+      MUTEX_PSHARED(word) == PTHREAD_PROCESS_PRIVATE &&  //
+      _weaken(nsync_mu_unlock)) {
+    _weaken(nsync_mu_unlock)((nsync_mu *)mutex);
+    return 0;
+  }
+#endif
+
+  // implement barebones normal mutexes
+  if (MUTEX_TYPE(word) == PTHREAD_MUTEX_NORMAL) {
+    if (_weaken(nsync_futex_wake_)) {
+      pthread_mutex_unlock_drepper(&mutex->_futex, MUTEX_PSHARED(word));
+    } else {
+      pthread_mutex_unlock_spin(&mutex->_futex);
+    }
+    return 0;
+  }
+
+  // handle recursive and error checking mutexes
+  return pthread_mutex_unlock_recursive(mutex, word);
+}

libc/intrin/pthread_spin_lock.c

@@ -38,8 +38,12 @@
  * @see pthread_spin_init
  */
 errno_t pthread_spin_lock(pthread_spinlock_t *spin) {
-  while (atomic_exchange_explicit(&spin->_lock, 1, memory_order_acquire)) {
-    pthread_pause_np();
+  for (;;) {
+    if (!atomic_exchange_explicit(&spin->_lock, 1, memory_order_acquire))
+      break;
+    for (;;)
+      if (!atomic_load_explicit(&spin->_lock, memory_order_relaxed))
+        break;
   }
   return 0;
 }

libc/intrin/pthread_yield_np.c

@@ -22,6 +22,8 @@
 #include "libc/runtime/syslib.internal.h"
 #include "libc/thread/thread.h"
 
+void sys_sched_yield(void);
+
 /**
  * Yields current thread's remaining timeslice to operating system.
  *
@@ -31,12 +33,15 @@ int pthread_yield_np(void) {
   if (IsXnuSilicon()) {
     __syslib->__pthread_yield_np();
   } else if (IsOpenbsd()) {
-    pthread_pause_np();  // sched_yield() is punishingly slow on OpenBSD
+    // sched_yield() is punishingly slow on OpenBSD
+    // it's ruinously slow it'll destroy everything
+    pthread_pause_np();
   } else {
-    sched_yield();
+    sys_sched_yield();
   }
   return 0;
 }
 
 __weak_reference(pthread_yield_np, thrd_yield);
+__weak_reference(pthread_yield_np, sched_yield);
 __weak_reference(pthread_yield_np, pthread_yield);

libc/intrin/sys_sched_yield.S

@@ -19,12 +19,11 @@
 #include "libc/dce.h"
 #include "libc/sysv/consts/nr.h"
 #include "libc/macros.internal.h"
-.privileged
 
 //	Relinquishes scheduled quantum.
 //
 //	@return	0 on success, or -1 w/ errno
-sched_yield:
+sys_sched_yield:
 #ifdef __x86_64__
 	push	%rbp
 	mov	%rsp,%rbp
@@ -107,5 +106,5 @@ sched_yield:
 #else
 #error "arch unsupported"
 #endif
-	.endfn	sched_yield,globl
+	.endfn	sys_sched_yield,globl
 	.previous

libc/isystem/__threading_support

@@ -1 +0,0 @@
-#include "third_party/libcxx/__threading_support"

libc/isystem/amxcomplexintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/amxcomplexintrin.internal.h"

libc/isystem/amxfp16intrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/amxfp16intrin.internal.h"

libc/isystem/avxifmaintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/avxifmaintrin.internal.h"

libc/isystem/avxneconvertintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/avxneconvertintrin.internal.h"

libc/isystem/avxvnniint16intrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/avxvnniint16intrin.internal.h"

libc/isystem/avxvnniint8intrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/avxvnniint8intrin.internal.h"

libc/isystem/bmmintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/bmmintrin.internal.h"

libc/isystem/cmpccxaddintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/cmpccxaddintrin.internal.h"

libc/isystem/prfchiintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/prfchiintrin.internal.h"

libc/isystem/raointintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/raointintrin.internal.h"

libc/isystem/sha512intrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/sha512intrin.internal.h"

libc/isystem/sm3intrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/sm3intrin.internal.h"

libc/isystem/sm4intrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/sm4intrin.internal.h"

libc/isystem/usermsrintrin.h

@@ -0,0 +1 @@
+#include "third_party/intel/usermsrintrin.internal.h"

libc/log/oncrash_arm64.c

@@ -266,7 +266,8 @@ static relegated void __oncrash_impl(int sig, siginfo_t *si, ucontext_t *ctx) {
         if (j)
           Append(b, " ");
         Append(b, "%s%016lx%s x%d%s", ColorRegister(r),
-               ctx->uc_mcontext.regs[r], reset, r, r == 8 || r == 9 ? " " : "");
+               ((uint64_t *)ctx->uc_mcontext.regs)[r], reset, r,
+               r == 8 || r == 9 ? " " : "");
       }
       Append(b, "\n");
     }

libc/math.h

@@ -159,10 +159,7 @@ typedef double double_t;
 #define fpclassify(x) \
   __builtin_fpclassify(FP_NAN, FP_INFINITE, FP_NORMAL, FP_SUBNORMAL, FP_ZERO, x)
 
-#define signbit(x)                                          \
-  (sizeof(x) == sizeof(long double) ? __builtin_signbitl(x) \
-   : sizeof(x) == sizeof(float)     ? __builtin_signbitf(x) \
-                                    : __builtin_signbit(x))
+#define signbit(x) __builtin_signbit(x)
 
 extern int signgam;
 

libc/mem/tinymalloc.inc

@@ -29,6 +29,10 @@
 #define TINYMALLOC_MAX_ALIGN sizeof(max_align_t)
 #endif
 
+#pragma GCC push_options
+#pragma GCC diagnostic ignored "-Wanalyzer-malloc-leak"
+#pragma GCC diagnostic ignored "-Wanalyzer-use-after-free"
+
 static struct {
   alignas(max_align_t) char bits[TINYMALLOC_MAX_BYTES];
   char *memory;
@@ -178,3 +182,5 @@ OutOfMemory:
   errno = ENOMEM;
   return 0;
 }
+
+#pragma GCC pop_options

libc/nexgen32e/nt2sysv.h

@@ -7,6 +7,10 @@
  *
  * This macro should be used when specifying callbacks in the WIN32 API.
  */
+#ifdef __x86_64__
 #define NT2SYSV(FUNCTION) TRAMPOLINE(FUNCTION, __nt2sysv)
+#else
+#define NT2SYSV(FUNCTION) FUNCTION
+#endif
 
 #endif /* COSMOPOLITAN_LIBC_NEXGEN32E_NT2SYSV_H_ */

libc/proc/execve-nt.greg.c

@@ -18,11 +18,11 @@
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/assert.h"
 #include "libc/calls/internal.h"
-#include "libc/intrin/fds.h"
 #include "libc/calls/struct/sigset.internal.h"
 #include "libc/calls/syscall-nt.internal.h"
 #include "libc/errno.h"
 #include "libc/fmt/itoa.h"
+#include "libc/intrin/fds.h"
 #include "libc/intrin/kprintf.h"
 #include "libc/mem/mem.h"
 #include "libc/nt/enum/processaccess.h"
@@ -109,10 +109,14 @@ textwindows int sys_execve_nt(const char *program, char *const argv[],
 
   // give child to libc/proc/proc.c worker thread in parent
   int64_t handle;
-  unassert(DuplicateHandle(GetCurrentProcess(), pi.hProcess, hParentProcess,
-                           &handle, 0, false, kNtDuplicateSameAccess));
-  unassert(!(handle & 0xFFFFFFFFFF000000));
-  TerminateThisProcess(0x23000000u | handle);
+  if (DuplicateHandle(GetCurrentProcess(), pi.hProcess, hParentProcess, &handle,
+                      0, false, kNtDuplicateSameAccess)) {
+    unassert(!(handle & 0xFFFFFFFFFF000000));
+    TerminateThisProcess(0x23000000u | handle);
+  } else {
+    kprintf("DuplicateHandle failed w/ %d\n", GetLastError());
+    TerminateThisProcess(ECHILD);
+  }
 }
 
 #endif /* __x86_64__ */

libc/proc/fork-nt.c

@@ -65,6 +65,7 @@
 #include "libc/thread/itimer.internal.h"
 #include "libc/thread/posixthread.internal.h"
 #include "libc/thread/tls.h"
+#include "libc/thread/tls2.internal.h"
 #ifdef __x86_64__
 
 extern long __klog_handle;
@@ -112,7 +113,8 @@ static dontinline textwindows ssize_t ForkIo2(
   ssize_t rc = ForkIo(h, buf, n, fn);
   if (ischild) {
     // prevent crashes
-    __tls_enabled_set(false);
+    __threaded = false;
+    __tls_enabled = false;
     __pid = __imp_GetCurrentProcessId();
     __klog_handle = 0;
     __maps.maps = 0;
@@ -265,13 +267,12 @@ textwindows void WinMainForked(void) {
   ReadOrDie(reader, __data_start, __data_end - __data_start);
   ReadOrDie(reader, __bss_start, __bss_end - __bss_start);
   kStartTsc = savetsc;
+  __tls_enabled = false;
   __threaded = false;
-  __tls_index = 0;
-  __tls_enabled_set(false);
 
   // fixup memory manager
-  __maps.free = 0;
   __maps.maps = 0;
+  __maps.freed = 0;
   __maps.count = 0;
   __maps.pages = 0;
   for (struct Tree *e = tree_first(maps); e; e = tree_next(e)) {
@@ -456,9 +457,10 @@ textwindows int sys_fork_nt(uint32_t dwCreationFlags) {
   } else {
     rc = 0;
     // re-apply code morphing for thread-local storage
-    __set_tls(tib);
+    __tls_index = TlsAlloc();
+    __set_tls_win32(tib);
     __morph_tls();
-    __tls_enabled_set(true);
+    __tls_enabled = true;
     // the child's pending signals is initially empty
     atomic_store_explicit(&__sig.pending, 0, memory_order_relaxed);
     atomic_store_explicit(&tib->tib_sigpending, 0, memory_order_relaxed);
@@ -471,9 +473,8 @@ textwindows int sys_fork_nt(uint32_t dwCreationFlags) {
     // reset core runtime services
     __proc_wipe();
     WipeKeystrokes();
-    if (_weaken(__itimer_wipe)) {
+    if (_weaken(__itimer_wipe))
       _weaken(__itimer_wipe)();
-    }
     // notify pthread join
     atomic_store_explicit(&_pthread_static.ptid, GetCurrentThreadId(),
                           memory_order_release);

libc/proc/fork.c

@@ -51,9 +51,18 @@ __static_yoink("_pthread_atfork");
 extern pthread_mutex_t _rand64_lock_obj;
 extern pthread_mutex_t _pthread_lock_obj;
 
+// fork needs to lock every lock, which makes it very single-threaded in
+// nature. the outermost lock matters the most because it serializes all
+// threads attempting to spawn processes. the outer lock can't be a spin
+// lock that a pthread_atfork() caller slipped in. to ensure it's a fair
+// lock, we add an additional one of our own, which protects other locks
+static pthread_mutex_t _fork_gil = PTHREAD_MUTEX_INITIALIZER;
+
 static void _onfork_prepare(void) {
   if (_weaken(_pthread_onfork_prepare))
     _weaken(_pthread_onfork_prepare)();
+  if (IsWindows())
+    __proc_lock();
   _pthread_lock();
   __maps_lock();
   __fds_lock();
@@ -66,32 +75,31 @@ static void _onfork_parent(void) {
   __fds_unlock();
   __maps_unlock();
   _pthread_unlock();
+  if (IsWindows())
+    __proc_unlock();
   if (_weaken(_pthread_onfork_parent))
     _weaken(_pthread_onfork_parent)();
 }
 
 static void _onfork_child(void) {
+  if (IsWindows())
+    __proc_wipe();
   __fds_lock_obj = (pthread_mutex_t)PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
   _rand64_lock_obj = (pthread_mutex_t)PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
   _pthread_lock_obj = (pthread_mutex_t)PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
   atomic_store_explicit(&__maps.lock, 0, memory_order_relaxed);
-  atomic_store_explicit(&__get_tls()->tib_relock_maps, 0, memory_order_relaxed);
   if (_weaken(_pthread_onfork_child))
     _weaken(_pthread_onfork_child)();
 }
 
-int _fork(uint32_t dwCreationFlags) {
+static int _forker(uint32_t dwCreationFlags) {
   long micros;
   struct Dll *e;
   struct timespec started;
   int ax, dx, tid, parent;
   parent = __pid;
-  BLOCK_SIGNALS;
-  if (IsWindows())
-    __proc_lock();
-  if (__threaded)
-    _onfork_prepare();
   started = timespec_real();
+  _onfork_prepare();
   if (!IsWindows()) {
     ax = sys_fork();
   } else {
@@ -142,21 +150,30 @@ int _fork(uint32_t dwCreationFlags) {
     atomic_store_explicit(&pt->pt_canceled, false, memory_order_relaxed);
 
     // run user fork callbacks
-    if (__threaded)
-      _onfork_child();
+    _onfork_child();
     STRACE("fork() → 0 (child of %d; took %ld us)", parent, micros);
   } else {
     // this is the parent process
-    if (__threaded)
-      _onfork_parent();
-    if (IsWindows())
-      __proc_unlock();
+    _onfork_parent();
     STRACE("fork() → %d% m (took %ld us)", ax, micros);
   }
-  ALLOW_SIGNALS;
   return ax;
 }
 
+int _fork(uint32_t dwCreationFlags) {
+  int rc;
+  BLOCK_SIGNALS;
+  pthread_mutex_lock(&_fork_gil);
+  rc = _forker(dwCreationFlags);
+  if (!rc) {
+    pthread_mutex_init(&_fork_gil, 0);
+  } else {
+    pthread_mutex_unlock(&_fork_gil);
+  }
+  ALLOW_SIGNALS;
+  return rc;
+}
+
 /**
  * Creates new process.
  *

libc/proc/kill-nt.c

@@ -59,9 +59,8 @@ textwindows int sys_kill_nt(int pid, int sig) {
         struct Dll *e;
         BLOCK_SIGNALS;
         __proc_lock();
-        for (e = dll_first(__proc.list); e; e = dll_next(__proc.list, e)) {
+        for (e = dll_first(__proc.list); e; e = dll_next(__proc.list, e))
           TerminateProcess(PROC_CONTAINER(e)->handle, sig);
-        }
         __proc_unlock();
         ALLOW_SIGNALS;
       }

libc/proc/posix_spawn.c

@@ -22,7 +22,6 @@
 #include "libc/calls/calls.h"
 #include "libc/calls/internal.h"
 #include "libc/calls/state.internal.h"
-#include "libc/intrin/fds.h"
 #include "libc/calls/struct/rlimit.h"
 #include "libc/calls/struct/rlimit.internal.h"
 #include "libc/calls/struct/rusage.internal.h"
@@ -39,6 +38,7 @@
 #include "libc/intrin/bsf.h"
 #include "libc/intrin/describeflags.h"
 #include "libc/intrin/dll.h"
+#include "libc/intrin/fds.h"
 #include "libc/intrin/strace.h"
 #include "libc/intrin/weaken.h"
 #include "libc/mem/alloca.h"
@@ -95,6 +95,10 @@
 
 #define CLOSER_CONTAINER(e) DLL_CONTAINER(struct Closer, elem, e)
 
+static atomic_bool has_vfork;  // i.e. not qemu/wsl/xnu/openbsd
+
+#ifdef __x86_64__
+
 struct Closer {
   int64_t handle;
   struct Dll elem;
@@ -106,8 +110,6 @@ struct SpawnFds {
   struct Dll *closers;
 };
 
-static atomic_bool has_vfork;  // i.e. not qemu/wsl/xnu/openbsd
-
 static textwindows int64_t spawnfds_handle(struct SpawnFds *fds, int fd) {
   if (__is_cloexec(fds->p + fd))
     return -1;
@@ -429,6 +431,8 @@ static textwindows dontinline errno_t posix_spawn_nt(
   return err;
 }
 
+#endif  // __x86_64__
+
 /**
  * Spawns process, the POSIX way, e.g.
  *
@@ -482,8 +486,10 @@ errno_t posix_spawn(int *pid, const char *path,
                     const posix_spawn_file_actions_t *file_actions,
                     const posix_spawnattr_t *attrp, char *const argv[],
                     char *const envp[]) {
+#ifdef __x86_64__
   if (IsWindows())
     return posix_spawn_nt(pid, path, file_actions, attrp, argv, envp);
+#endif
   int pfds[2];
   bool use_pipe;
   volatile int status = 0;

libc/proc/proc.c

@@ -30,7 +30,6 @@
 #include "libc/intrin/strace.h"
 #include "libc/intrin/weaken.h"
 #include "libc/mem/leaks.h"
-#include "libc/mem/mem.h"
 #include "libc/nt/accounting.h"
 #include "libc/nt/enum/processaccess.h"
 #include "libc/nt/enum/processcreationflags.h"
@@ -45,12 +44,16 @@
 #include "libc/nt/synchronization.h"
 #include "libc/nt/thread.h"
 #include "libc/proc/proc.internal.h"
+#include "libc/runtime/runtime.h"
 #include "libc/str/str.h"
+#include "libc/sysv/consts/map.h"
+#include "libc/sysv/consts/prot.h"
 #include "libc/sysv/consts/sa.h"
 #include "libc/sysv/consts/sicode.h"
 #include "libc/sysv/consts/sig.h"
 #include "libc/sysv/errfuns.h"
 #include "libc/thread/tls.h"
+#include "third_party/nsync/mu.h"
 #ifdef __x86_64__
 
 /**
@@ -273,27 +276,21 @@ textwindows void __proc_wipe(void) {
 textwindows struct Proc *__proc_new(void) {
   struct Dll *e;
   struct Proc *proc = 0;
-  // fork() + wait() don't depend on malloc() so neither shall we
-  if (__proc.allocated < ARRAYLEN(__proc.pool)) {
-    proc = __proc.pool + __proc.allocated++;
-  } else {
-    if ((e = dll_first(__proc.free))) {
-      proc = PROC_CONTAINER(e);
-      dll_remove(&__proc.free, &proc->elem);
-    }
-    if (!proc) {
-      if (_weaken(malloc)) {
-        proc = may_leak(_weaken(malloc)(sizeof(struct Proc)));
-      } else {
-        enomem();
-        return 0;
-      }
-    }
+  if ((e = dll_first(__proc.free))) {
+    proc = PROC_CONTAINER(e);
+    dll_remove(&__proc.free, &proc->elem);
   }
   if (proc) {
     bzero(proc, sizeof(*proc));
-    dll_init(&proc->elem);
+  } else {
+    proc = mmap(0, sizeof(struct Proc), PROT_READ | PROT_WRITE,
+                MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    if (proc == MAP_FAILED) {
+      enomem();
+      return 0;
+    }
   }
+  dll_init(&proc->elem);
   return proc;
 }
 

libc/proc/proc.internal.h

@@ -36,7 +36,6 @@ struct Procs {
   struct Dll *free;
   struct Dll *undead;
   struct Dll *zombies;
-  struct Proc pool[8];
   unsigned allocated;
   struct rusage ruchlds;
 };

libc/runtime/clone.c

@@ -589,7 +589,9 @@ int sys_clone_linux(int flags,         // rdi
 
 static int LinuxThreadEntry(void *arg, int tid) {
   struct LinuxCloneArgs *wt = arg;
+#if defined(__x86_64__)
   sys_set_tls(ARCH_SET_GS, wt->tls);
+#endif
   return wt->func(wt->arg, tid);
 }
 

libc/runtime/cosmo.S

@@ -45,7 +45,7 @@ cosmo:	push	%rbp
 #endif /* SYSDEBUG */
 
 #ifndef NOX87
-//	Windows always initializes FPU to douuble precision.
+//	Windows always initializes FPU to double precision.
 //	WSL breaks Linux ABI by initializing FPU to double precision.
 //	This code makes long double long again.
 //

libc/runtime/enable_tls.c

@@ -251,6 +251,8 @@ textstartup void __enable_tls(void) {
   atomic_store_explicit(&_pthread_static.ptid, tid, memory_order_release);
 
   // ask the operating system to change the x86 segment register
+  if (IsWindows())
+    __tls_index = TlsAlloc();
   __set_tls(tib);
 
 #ifdef __x86_64__

libc/runtime/getsymboltable.c

@@ -17,6 +17,8 @@
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
 #include "libc/assert.h"
+#include "libc/atomic.h"
+#include "libc/cosmo.h"
 #include "libc/errno.h"
 #include "libc/intrin/promises.h"
 #include "libc/intrin/strace.h"
@@ -27,14 +29,12 @@
 #include "libc/runtime/symbols.internal.h"
 #include "libc/runtime/zipos.internal.h"
 #include "libc/str/str.h"
-#include "libc/thread/thread.h"
 #include "libc/x/x.h"
 #include "libc/zip.internal.h"
 #include "third_party/puff/puff.h"
 
 __static_yoink("__get_symbol");
 
-static pthread_spinlock_t g_lock;
 struct SymbolTable *__symtab;  // for kprintf
 
 static ssize_t GetZipFile(struct Zipos *zipos, const char *name) {
@@ -100,6 +100,25 @@ static struct SymbolTable *GetSymbolTableFromElf(void) {
   }
 }
 
+static void GetSymbolTableInit(void) {
+  struct Zipos *z;
+  int e = errno;
+  if (!__symtab && !__isworker) {
+    if (_weaken(__zipos_get) && (z = _weaken(__zipos_get)())) {
+      if ((__symtab = GetSymbolTableFromZip(z))) {
+        __symtab->names =
+            (uint32_t *)((char *)__symtab + __symtab->names_offset);
+        __symtab->name_base =
+            (char *)((char *)__symtab + __symtab->name_base_offset);
+      }
+    }
+    if (!__symtab) {
+      __symtab = GetSymbolTableFromElf();
+    }
+  }
+  errno = e;
+}
+
 /**
  * Returns symbol table singleton.
  *
@@ -121,24 +140,7 @@ static struct SymbolTable *GetSymbolTableFromElf(void) {
  * @return symbol table, or NULL if not found
  */
 struct SymbolTable *GetSymbolTable(void) {
-  struct Zipos *z;
-  if (pthread_spin_trylock(&g_lock))
-    return 0;
-  int e = errno;
-  if (!__symtab && !__isworker) {
-    if (_weaken(__zipos_get) && (z = _weaken(__zipos_get)())) {
-      if ((__symtab = GetSymbolTableFromZip(z))) {
-        __symtab->names =
-            (uint32_t *)((char *)__symtab + __symtab->names_offset);
-        __symtab->name_base =
-            (char *)((char *)__symtab + __symtab->name_base_offset);
-      }
-    }
-    if (!__symtab) {
-      __symtab = GetSymbolTableFromElf();
-    }
-  }
-  errno = e;
-  pthread_spin_unlock(&g_lock);
+  static atomic_uint once;
+  cosmo_once(&once, GetSymbolTableInit);
   return __symtab;
 }

libc/runtime/runtime.h

@@ -4,6 +4,7 @@ COSMOPOLITAN_C_START_
 /*───────────────────────────────────────────────────────────────────────────│─╗
 │ cosmopolitan § runtime                                                   ─╬─│┼
 ╚────────────────────────────────────────────────────────────────────────────│*/
+/* clang-format off */
 
 #ifdef __x86_64__
 typedef long jmp_buf[8];
@@ -22,11 +23,9 @@ typedef unsigned long jmp_buf[26];
 void mcount(void) libcesque;
 int daemon(int, int) libcesque;
 unsigned long getauxval(unsigned long) libcesque;
-int setjmp(jmp_buf)
-libcesque returnstwice paramsnonnull();
+int setjmp(jmp_buf) libcesque returnstwice paramsnonnull();
 void longjmp(jmp_buf, int) libcesque wontreturn paramsnonnull();
-int _setjmp(jmp_buf)
-libcesque returnstwice paramsnonnull();
+int _setjmp(jmp_buf) libcesque returnstwice paramsnonnull();
 int sigsetjmp(sigjmp_buf, int) libcesque returnstwice paramsnonnull();
 void siglongjmp(sigjmp_buf, int) libcesque wontreturn paramsnonnull();
 void _longjmp(jmp_buf, int) libcesque wontreturn paramsnonnull();
@@ -37,7 +36,7 @@ void quick_exit(int) wontreturn;
 void abort(void) wontreturn;
 int atexit(void (*)(void)) paramsnonnull() libcesque;
 char *getenv(const char *) paramsnonnull() __wur nosideeffect libcesque;
-int putenv(char *) libcesque;
+int putenv(char *) libcesque __read_write(1);
 int setenv(const char *, const char *, int) libcesque;
 int unsetenv(const char *) libcesque;
 int clearenv(void) libcesque;
@@ -52,8 +51,8 @@ int munlock(const void *, size_t) libcesque;
 long gethostid(void) libcesque;
 int sethostid(long) libcesque;
 char *getlogin(void) libcesque;
-int getlogin_r(char *, size_t) libcesque;
-int login_tty(int) libcesque;
+int getlogin_r(char *, size_t) libcesque __write_only(1, 2);
+int login_tty(int) libcesque __fd_arg(1);
 int getpagesize(void) pureconst libcesque;
 int getgransize(void) pureconst libcesque;
 int syncfs(int) dontthrow libcesque;
@@ -88,8 +87,8 @@ extern size_t __virtualsize;
 extern size_t __stackmax;
 extern bool32 __isworker;
 /* utilities */
-void _intsort(int *, size_t) libcesque;
-void _longsort(long *, size_t) libcesque;
+void _intsort(int *, size_t) libcesque __read_write(1, 2);
+void _longsort(long *, size_t) libcesque __read_write(1, 2);
 /* diagnostics */
 void ShowCrashReports(void) libcesque;
 int ftrace_install(void) libcesque;
@@ -107,8 +106,8 @@ int __open_executable(void) libcesque;
 int verynice(void) libcesque;
 void __warn_if_powersave(void) libcesque;
 void _Exit1(int) libcesque wontreturn libcesque;
-void __paginate(int, const char *) libcesque;
-void __paginate_file(int, const char *) libcesque;
+void __paginate(int, const char *) libcesque __fd_arg(1);
+void __paginate_file(int, const char *) libcesque __fd_arg(1);
 /* memory management */
 void _weakfree(void *) libcesque;
 void *_mapanon(size_t) attributeallocsize((1)) mallocesque libcesque;

libc/runtime/set_tls.c

@@ -38,7 +38,7 @@ dontinstrument textstartup void __set_tls(struct CosmoTib *tib) {
 #ifdef __x86_64__
   // ask the operating system to change the x86 segment register
   if (IsWindows()) {
-    asm("mov\t%1,%%gs:%0" : "=m"(*((long *)0x1480 + __tls_index)) : "r"(tib));
+    __set_tls_win32(tib);
   } else if (IsLinux()) {
     sys_set_tls(ARCH_SET_GS, tib);
   } else if (IsFreebsd()) {

libc/runtime/stack.h

@@ -6,7 +6,11 @@
 /**
  * Returns preferred size and alignment of thread stack.
  */
+#ifndef MODE_DBG
 #define GetStackSize() 81920
+#else
+#define GetStackSize() 163840
+#endif
 
 /**
  * Returns preferred stack guard size.

libc/runtime/warnifpowersave.c

@@ -36,6 +36,8 @@
   "/sys/devices/system/cpu/cpu*/cpufreq/scaling_governor\n"
 
 void __warn_if_powersave(void) {
+  if (1)
+    return;
   int e, fd;
   char buf[16] = {0};
   if (IsLinux()) {

libc/runtime/weakfree.c

@@ -24,7 +24,6 @@
  * Thunks free() if it's linked, otherwise do nothing.
  */
 void _weakfree(void *p) {
-  if (_weaken(free)) {
+  if (_weaken(free))
     _weaken(free)(p);
-  }
 }

libc/runtime/zipos.internal.h

@@ -6,6 +6,12 @@ COSMOPOLITAN_C_START_
 
 #define ZIPOS_SYNTHETIC_DIRECTORY 0
 
+#ifndef __cplusplus
+#define _ZIPOS_ATOMIC(x) _Atomic(x)
+#else
+#define _ZIPOS_ATOMIC(x) x
+#endif
+
 struct stat;
 struct iovec;
 struct Zipos;
@@ -21,8 +27,8 @@ struct ZiposHandle {
   size_t size;
   size_t mapsize;
   size_t cfile;
-  _Atomic(size_t) refs;
-  _Atomic(size_t) pos;
+  _ZIPOS_ATOMIC(size_t) refs;
+  _ZIPOS_ATOMIC(size_t) pos;
   uint8_t *mem;
   uint8_t data[];
 };

libc/sock/sock.h

@@ -17,21 +17,22 @@ libcesque uint32_t ntohl(uint32_t) pureconst;
 #define ntohl(x) __builtin_bswap32(x)
 #endif
 
+/* clang-format off */
 const char *inet_ntop(int, const void *, char *, uint32_t) libcesque;
 int inet_pton(int, const char *, void *) libcesque;
 uint32_t inet_addr(const char *) libcesque;
 libcesque uint32_t *GetHostIps(void) __wur;
 
 int socket(int, int, int) libcesque;
-int listen(int, int) libcesque;
-int shutdown(int, int) libcesque;
-ssize_t send(int, const void *, size_t, int) libcesque;
-ssize_t recv(int, void *, size_t, int) libcesque;
-ssize_t sendfile(int, int, int64_t *, size_t) libcesque;
-int getsockopt(int, int, int, void *, uint32_t *) libcesque;
-int setsockopt(int, int, int, const void *, uint32_t) libcesque;
+int listen(int, int) libcesque __fd_arg(1);
+int shutdown(int, int) libcesque __fd_arg(1);
+ssize_t send(int, const void *, size_t, int) libcesque __fd_arg(1) __read_only(2, 3);
+ssize_t recv(int, void *, size_t, int) libcesque __fd_arg(1) __write_only(2, 3);
+ssize_t sendfile(int, int, int64_t *, size_t) libcesque __fd_arg(1) __fd_arg(2) __read_write(3);
+int getsockopt(int, int, int, void *, uint32_t *) libcesque __fd_arg(1);
+int setsockopt(int, int, int, const void *, uint32_t) libcesque __fd_arg(1);
 int socketpair(int, int, int, int[2]) libcesque;
-int sockatmark(int) libcesque;
+int sockatmark(int) libcesque __fd_arg(1);
 
 COSMOPOLITAN_C_END_
 #endif /* COSMOPOLITAN_LIBC_SOCK_SOCK_H_ */

libc/stdio/flockfile.c

@@ -16,6 +16,7 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/assert.h"
 #include "libc/stdio/fflush.internal.h"
 #include "libc/stdio/internal.h"
 #include "libc/stdio/stdio.h"
@@ -26,6 +27,7 @@
  * Acquires reentrant lock on stdio object, blocking if needed.
  */
 void flockfile(FILE *f) {
+  unassert(f != NULL);
   pthread_mutex_lock(&f->lock);
 }
 

libc/stdio/fmt.c

@@ -449,7 +449,10 @@ static int __fmt_stoa(int out(const char *, void *, size_t), void *arg,
     } else if (signbit == 15) {
       precision = strnlen16((const char16_t *)p, precision);
     } else {
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wstringop-overread"
       precision = strnlen(p, precision);
+#pragma GCC diagnostic pop
     }
   }
 

libc/stdio/freopen.c

@@ -16,6 +16,7 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/assert.h"
 #include "libc/calls/calls.h"
 #include "libc/stdio/internal.h"
 #include "libc/stdio/stdio.h"
@@ -37,8 +38,8 @@
  * @return stream object if successful, or NULL w/ errno
  */
 FILE *freopen(const char *pathname, const char *mode, FILE *stream) {
-  int fd;
   FILE *res;
+  int fd, fd2;
   unsigned flags;
   flags = fopenflags(mode);
   flockfile(stream);
@@ -46,19 +47,30 @@ FILE *freopen(const char *pathname, const char *mode, FILE *stream) {
   if (pathname) {
     /* open new stream, overwriting existing alloc */
     if ((fd = open(pathname, flags, 0666)) != -1) {
-      dup3(fd, stream->fd, flags & O_CLOEXEC);
+      fd2 = dup3(fd, stream->fd, flags & O_CLOEXEC);
       close(fd);
-      stream->iomode = flags;
-      stream->beg = 0;
-      stream->end = 0;
-      res = stream;
+      if (fd2 != -1) {
+        stream->fd = fd2;
+        stream->iomode = flags;
+        stream->beg = 0;
+        stream->end = 0;
+        res = stream;
+      } else {
+        res = NULL;
+      }
     } else {
       res = NULL;
     }
   } else {
-    fcntl(stream->fd, F_SETFD, !!(flags & O_CLOEXEC));
-    fcntl(stream->fd, F_SETFL, flags & ~O_CLOEXEC);
-    res = stream;
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wanalyzer-fd-use-without-check"
+    if (fcntl(stream->fd, F_SETFD, !!(flags & O_CLOEXEC)) != -1 &&
+        fcntl(stream->fd, F_SETFL, flags & ~O_CLOEXEC) != -1) {
+#pragma GCC diagnostic pop
+      res = stream;
+    } else {
+      res = NULL;
+    }
   }
   funlockfile(stream);
   return res;

libc/stdio/iconv.c

@@ -1,5 +1,5 @@
-/*-*- mode:c;indent-tabs-mode:nil;c-basic-offset:2;tab-width:8;coding:utf-8 -*-│
-│ vi: set noet ft=c ts=2 sts=2 sw=2 fenc=utf-8                             :vi │
+/*-*- mode:c;indent-tabs-mode:t;c-basic-offset:8;tab-width:8;coding:utf-8   -*-│
+│ vi: set noet ft=c ts=8 sw=8 fenc=utf-8                                   :vi │
 ╚──────────────────────────────────────────────────────────────────────────────╝
 │                                                                              │
 │  Musl Libc                                                                   │
@@ -334,6 +334,8 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
 		case UCS2:
 		case UTF_16:
 			l = 0;
+			if (!scd)
+				goto starved;
 			if (!scd->state) {
 				if (*inb < 2) goto starved;
 				c = get_16((void *)*in, 0);
@@ -347,6 +349,8 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
 			continue;
 		case UTF_32:
 			l = 0;
+			if (!scd)
+				goto starved;
 			if (!scd->state) {
 				if (*inb < 4) goto starved;
 				c = get_32((void *)*in, 0);
@@ -398,6 +402,7 @@ size_t iconv(iconv_t cd, char **restrict in, size_t *restrict inb, char **restri
 			if (!c) goto ilseq;
 			break;
 		case ISO2022_JP:
+			if (!scd) goto starved;
 			if (c >= 128) goto ilseq;
 			if (c == '\033') {
 				l = 3;

libc/stdio/nftw.c

@@ -102,15 +102,24 @@ static int do_nftw(char *path,
 		dfd = open(path, O_RDONLY | O_DIRECTORY);
 		err = errno;
 		if (dfd < 0 && err == EACCES) type = FTW_DNR;
-		if (!fd_limit) close(dfd);
+		if (!fd_limit) {
+			close(dfd);
+			dfd = -1;
+		}
         }
 
-	if (!(flags & FTW_DEPTH) && (r=fn(path, &st, type, &lev)))
+	if (!(flags & FTW_DEPTH) && (r=fn(path, &st, type, &lev))) {
+		if (dfd != -1)
+			close(dfd);
 		return r;
+	}
 
 	for (; h; h = h->chain)
-		if (h->dev == st.st_dev && h->ino == st.st_ino)
+		if (h->dev == st.st_dev && h->ino == st.st_ino) {
+			if (dfd != -1)
+				close(dfd);
 			return 0;
+		}
 
 	if ((type == FTW_D || type == FTW_DP) && fd_limit) {
 		if (dfd < 0) {

libc/stdio/popen.c

@@ -75,7 +75,10 @@ FILE *popen(const char *cmdline, const char *mode) {
   if ((f = fdopen(pipefds[dir], mode))) {
     switch ((pid = fork())) {
       case 0:
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wanalyzer-fd-leak"
         unassert(dup2(pipefds[!dir], !dir) == !dir);
+#pragma GCC diagnostic pop
         // we can't rely on cloexec because cocmd builtins don't execve
         if (pipefds[0] != !dir)
           unassert(!close(pipefds[0]));

libc/stdio/scandir.c

@@ -69,7 +69,9 @@ int scandir(const char *path, struct dirent ***res,
 	}
 	errno = old_errno;
 
-	if (cmp) qsort(names, cnt, sizeof *names, (int (*)(const void *, const void *))cmp);
+	if (cmp && names) {
+		qsort(names, cnt, sizeof *names, (int (*)(const void *, const void *))cmp);
+	}
 	*res = names;
 	return cnt;
 }

libc/stdio/stdio.h

@@ -19,6 +19,7 @@ COSMOPOLITAN_C_START_
 /*───────────────────────────────────────────────────────────────────────────│─╗
 │ cosmopolitan § standard i/o                                              ─╬─│┼
 ╚────────────────────────────────────────────────────────────────────────────│*/
+/* clang-format off */
 
 struct FILE;
 typedef struct FILE FILE;
@@ -27,147 +28,146 @@ extern FILE *stdin;
 extern FILE *stdout;
 extern FILE *stderr;
 
-errno_t ferror(FILE *) libcesque paramsnonnull();
-void clearerr(FILE *) libcesque paramsnonnull();
-int feof(FILE *) libcesque paramsnonnull();
-int getc(FILE *) libcesque paramsnonnull();
-int putc(int, FILE *) libcesque paramsnonnull();
-int fflush(FILE *) libcesque;
-int fpurge(FILE *) libcesque;
-int fgetc(FILE *) libcesque paramsnonnull();
-char *fgetln(FILE *, size_t *) libcesque paramsnonnull((1));
-int ungetc(int, FILE *) libcesque paramsnonnull();
-int fileno(FILE *) libcesque paramsnonnull() nosideeffect;
-int fputc(int, FILE *) libcesque paramsnonnull();
-int fputs(const char *, FILE *) libcesque paramsnonnull();
-int fputws(const wchar_t *, FILE *) libcesque paramsnonnull();
-void flockfile(FILE *) libcesque paramsnonnull();
-void funlockfile(FILE *) libcesque paramsnonnull();
-int ftrylockfile(FILE *) libcesque paramsnonnull();
-char *fgets(char *, int, FILE *) libcesque paramsnonnull();
-wchar_t *fgetws(wchar_t *, int, FILE *) libcesque paramsnonnull();
-wint_t putwc(wchar_t, FILE *) libcesque paramsnonnull();
-wint_t fputwc(wchar_t, FILE *) libcesque paramsnonnull();
+errno_t ferror(FILE *) libcesque paramsnonnull() __read_write(1);
+void clearerr(FILE *) libcesque paramsnonnull() __read_write(1);
+int feof(FILE *) libcesque paramsnonnull() __read_write(1);
+int getc(FILE *) libcesque paramsnonnull() __read_write(1);
+int putc(int, FILE *) libcesque paramsnonnull() __read_write(2);
+int fflush(FILE *) libcesque __read_write(1);
+int fpurge(FILE *) libcesque __read_write(1);
+int fgetc(FILE *) libcesque paramsnonnull() __read_write(1);
+char *fgetln(FILE *, size_t *) libcesque paramsnonnull((1)) __read_write(1) __write_only(2);
+int ungetc(int, FILE *) libcesque paramsnonnull() __write_only(2);
+int fileno(FILE *) libcesque paramsnonnull() nosideeffect __write_only(1);
+int fputc(int, FILE *) libcesque paramsnonnull() __write_only(2);
+int fputs(const char *, FILE *) libcesque paramsnonnull() __write_only(2);
+int fputws(const wchar_t *, FILE *) libcesque paramsnonnull() __write_only(2);
+void flockfile(FILE *) libcesque __write_only(1);
+void funlockfile(FILE *) libcesque paramsnonnull() __write_only(1);
+int ftrylockfile(FILE *) libcesque paramsnonnull() __write_only(1);
+char *fgets(char *, int, FILE *) libcesque paramsnonnull() __write_only(1, 2) __read_write(3);
+wchar_t *fgetws(wchar_t *, int, FILE *) libcesque paramsnonnull() __write_only(1, 2) __read_write(3);
+wint_t putwc(wchar_t, FILE *) libcesque paramsnonnull() __write_only(2);
+wint_t fputwc(wchar_t, FILE *) libcesque paramsnonnull() __write_only(2);
 wint_t putwchar(wchar_t) libcesque;
 wint_t getwchar(void) libcesque;
-wint_t getwc(FILE *) libcesque paramsnonnull();
-wint_t fgetwc(FILE *) libcesque paramsnonnull();
-wint_t ungetwc(wint_t, FILE *) libcesque paramsnonnull();
+wint_t getwc(FILE *) libcesque paramsnonnull() __write_only(1);
+wint_t fgetwc(FILE *) libcesque paramsnonnull() __write_only(1);
+wint_t ungetwc(wint_t, FILE *) libcesque paramsnonnull() __write_only(2);
 int getchar(void) libcesque;
 int putchar(int) libcesque;
-int puts(const char *) libcesque;
-ssize_t getline(char **, size_t *, FILE *) libcesque paramsnonnull();
-ssize_t getdelim(char **, size_t *, int, FILE *) libcesque paramsnonnull();
-FILE *fopen(const char *, const char *) libcesque paramsnonnull((2)) __wur;
-FILE *fdopen(int, const char *) libcesque paramsnonnull() __wur;
-FILE *fmemopen(void *, size_t, const char *) libcesque paramsnonnull((3)) __wur;
-FILE *freopen(const char *, const char *, FILE *) paramsnonnull((2, 3));
-size_t fread(void *, size_t, size_t, FILE *) libcesque paramsnonnull((4));
-size_t fwrite(const void *, size_t, size_t, FILE *) paramsnonnull((4));
-int fclose(FILE *) libcesque;
-int fseek(FILE *, long, int) libcesque paramsnonnull();
-long ftell(FILE *) libcesque paramsnonnull();
-int fseeko(FILE *, int64_t, int) libcesque paramsnonnull();
-int64_t ftello(FILE *) libcesque paramsnonnull();
-void rewind(FILE *) libcesque paramsnonnull();
-int fopenflags(const char *) libcesque paramsnonnull();
-void setlinebuf(FILE *) libcesque;
-void setbuf(FILE *, char *) libcesque;
-void setbuffer(FILE *, char *, size_t) libcesque;
-int setvbuf(FILE *, char *, int, size_t) libcesque;
-int pclose(FILE *) libcesque;
-char *ctermid(char *) libcesque;
-void perror(const char *) libcesque relegated;
+int puts(const char *) libcesque __read_only(1);
+
+ssize_t getline(char **, size_t *, FILE *) libcesque paramsnonnull() __read_write(1) __read_write(2) __read_write(3);
+ssize_t getdelim(char **, size_t *, int, FILE *) libcesque paramsnonnull() __read_write(1) __read_write(2) __read_write(4);
+FILE *fopen(const char *, const char *) libcesque paramsnonnull((2)) __read_only(1) __read_only(2) __wur;
+FILE *fdopen(int, const char *) libcesque paramsnonnull() __read_only(2) __wur;
+FILE *fmemopen(void *, size_t, const char *) libcesque paramsnonnull((3)) __read_write(1) __read_only(3) __wur;
+FILE *freopen(const char *, const char *, FILE *) paramsnonnull((2, 3)) __read_only(1) __read_only(2) __read_write(3);
+size_t fread(void *, size_t, size_t, FILE *) libcesque paramsnonnull((4)) __write_only(1) __read_write(4);
+size_t fwrite(const void *, size_t, size_t, FILE *) paramsnonnull((4)) __read_only(1) __read_write(4);
+int fclose(FILE *) libcesque __read_write(1);
+int fseek(FILE *, long, int) libcesque paramsnonnull() __read_write(1);
+long ftell(FILE *) libcesque paramsnonnull() __read_write(1);
+int fseeko(FILE *, int64_t, int) libcesque paramsnonnull() __read_write(1);
+int64_t ftello(FILE *) libcesque paramsnonnull() __read_write(1);
+void rewind(FILE *) libcesque paramsnonnull() __read_write(1);
+int fopenflags(const char *) libcesque paramsnonnull() __read_only(1);
+void setlinebuf(FILE *) libcesque __read_write(1);
+void setbuf(FILE *, char *) libcesque __read_write(1) __write_only(2);
+void setbuffer(FILE *, char *, size_t) libcesque __read_write(1) __write_only(2);
+int setvbuf(FILE *, char *, int, size_t) libcesque __read_write(1);
+int pclose(FILE *) libcesque __read_write(1);
+char *ctermid(char *) libcesque __write_only(1);
+void perror(const char *) libcesque relegated __read_only(1);
 
 typedef uint64_t fpos_t;
-char *gets(char *) libcesque paramsnonnull();
-int fgetpos(FILE *, fpos_t *) libcesque paramsnonnull();
-int fsetpos(FILE *, const fpos_t *) libcesque paramsnonnull();
+char *gets(char *) libcesque paramsnonnull() __write_only(1);
+int fgetpos(FILE *, fpos_t *) libcesque paramsnonnull() __read_write(1) __write_only(2);
+int fsetpos(FILE *, const fpos_t *) libcesque paramsnonnull() __read_write(1) __read_only(2);
 
 FILE *tmpfile(void) libcesque __wur;
-char *tmpnam(char *) libcesque __wur;
-char *tmpnam_r(char *) libcesque __wur;
+char *tmpnam(char *) libcesque __write_only(1) __wur;
+char *tmpnam_r(char *) libcesque __write_only(1) __wur;
 
-FILE *popen(const char *, const char *) libcesque;
+FILE *popen(const char *, const char *) libcesque __read_only(1) __read_only(2);
 
 /*───────────────────────────────────────────────────────────────────────────│─╗
 │ cosmopolitan § standard i/o » formatting                                 ─╬─│┼
 ╚────────────────────────────────────────────────────────────────────────────│*/
 
-int printf(const char *, ...) printfesque(1) paramsnonnull((1)) libcesque;
-int vprintf(const char *, va_list) paramsnonnull() libcesque;
-int fprintf(FILE *, const char *, ...) printfesque(2)
-    paramsnonnull((1, 2)) libcesque;
-int vfprintf(FILE *, const char *, va_list) paramsnonnull() libcesque;
-int scanf(const char *, ...) libcesque scanfesque(1);
-int vscanf(const char *, va_list) libcesque;
-int fscanf(FILE *, const char *, ...) libcesque scanfesque(2);
-int vfscanf(FILE *, const char *, va_list) libcesque;
+int printf(const char *, ...) printfesque(1) paramsnonnull((1)) libcesque __read_only(1);
+int vprintf(const char *, va_list) paramsnonnull() libcesque __read_only(1);
+int fprintf(FILE *, const char *, ...) printfesque(2) paramsnonnull((1, 2)) libcesque __read_write(1) __read_only(2);
+int vfprintf(FILE *, const char *, va_list) paramsnonnull() libcesque __read_write(1) __read_only(2);
+int scanf(const char *, ...) libcesque scanfesque(1) __read_only(1);
+int vscanf(const char *, va_list) libcesque __read_only(1);
+int fscanf(FILE *, const char *, ...) libcesque scanfesque(2) __read_write(1) __read_only(2);
+int vfscanf(FILE *, const char *, va_list) libcesque __read_write(1) __read_only(2);
 
-int snprintf(char *, size_t, const char *, ...) printfesque(3) libcesque;
-int vsnprintf(char *, size_t, const char *, va_list) libcesque;
-int sprintf(char *, const char *, ...) libcesque;
-int vsprintf(char *, const char *, va_list) libcesque;
+int snprintf(char *, size_t, const char *, ...) printfesque(3) libcesque __write_only(1) __read_only(3);
+int vsnprintf(char *, size_t, const char *, va_list) libcesque __write_only(1) __read_only(3);
+int sprintf(char *, const char *, ...) libcesque __write_only(1) __read_only(2);
+int vsprintf(char *, const char *, va_list) libcesque __write_only(1) __read_only(2);
 
-int fwprintf(FILE *, const wchar_t *, ...) libcesque;
-int fwscanf(FILE *, const wchar_t *, ...) libcesque;
-int swprintf(wchar_t *, size_t, const wchar_t *, ...) libcesque;
-int swscanf(const wchar_t *, const wchar_t *, ...) libcesque;
-int vfwprintf(FILE *, const wchar_t *, va_list) libcesque;
-int vfwscanf(FILE *, const wchar_t *, va_list) libcesque;
-int vswprintf(wchar_t *, size_t, const wchar_t *, va_list) libcesque;
-int vswscanf(const wchar_t *, const wchar_t *, va_list) libcesque;
-int vwprintf(const wchar_t *, va_list) libcesque;
-int vwscanf(const wchar_t *, va_list) libcesque;
-int wprintf(const wchar_t *, ...) libcesque;
-int wscanf(const wchar_t *, ...) libcesque;
-int fwide(FILE *, int) libcesque;
+int fwprintf(FILE *, const wchar_t *, ...) libcesque __read_write(1) __read_only(2);
+int fwscanf(FILE *, const wchar_t *, ...) libcesque __read_write(1) __read_only(2);
+int swprintf(wchar_t *, size_t, const wchar_t *, ...) libcesque __write_only(1) __read_only(3);
+int swscanf(const wchar_t *, const wchar_t *, ...) libcesque __read_only(1) __read_only(2);
+int vfwprintf(FILE *, const wchar_t *, va_list) libcesque __read_write(1) __read_only(2);
+int vfwscanf(FILE *, const wchar_t *, va_list) libcesque __read_write(1) __read_only(2);
+int vswprintf(wchar_t *, size_t, const wchar_t *, va_list) libcesque __write_only(1) __read_only(3);
+int vswscanf(const wchar_t *, const wchar_t *, va_list) libcesque __read_only(1) __read_only(2);
+int vwprintf(const wchar_t *, va_list) libcesque __read_only(1);
+int vwscanf(const wchar_t *, va_list) libcesque __read_only(1);
+int wprintf(const wchar_t *, ...) libcesque __read_only(1);
+int wscanf(const wchar_t *, ...) libcesque __read_only(1);
+int fwide(FILE *, int) libcesque __read_write(1);
 
-int sscanf(const char *, const char *, ...) libcesque scanfesque(2);
-int vsscanf(const char *, const char *, va_list) libcesque;
+int sscanf(const char *, const char *, ...) libcesque scanfesque(2) __read_only(1) __read_only(2);
+int vsscanf(const char *, const char *, va_list) libcesque __read_only(1) __read_only(2);
 
 /*───────────────────────────────────────────────────────────────────────────│─╗
 │ cosmopolitan § standard i/o » allocating                                 ─╬─│┼
 ╚────────────────────────────────────────────────────────────────────────────│*/
 
-int asprintf(char **, const char *, ...) printfesque(2)
-    paramsnonnull((1, 2)) libcesque;
-int vasprintf(char **, const char *, va_list) paramsnonnull() libcesque;
+int asprintf(char **, const char *, ...) printfesque(2) paramsnonnull((1, 2)) libcesque __write_only(1);
+int vasprintf(char **, const char *, va_list) paramsnonnull() libcesque __write_only(1);
 
 /*───────────────────────────────────────────────────────────────────────────│─╗
 │ cosmopolitan § standard i/o » without mutexes                            ─╬─│┼
 ╚────────────────────────────────────────────────────────────────────────────│*/
 
-int getc_unlocked(FILE *) libcesque paramsnonnull();
-int puts_unlocked(const char *) libcesque;
+int getc_unlocked(FILE *) libcesque paramsnonnull() __read_write(1);
+int puts_unlocked(const char *) libcesque __read_only(1);
 int getchar_unlocked(void) libcesque;
-int putc_unlocked(int, FILE *) libcesque paramsnonnull();
+int putc_unlocked(int, FILE *) libcesque paramsnonnull() __read_write(2);
 int putchar_unlocked(int) libcesque;
-void clearerr_unlocked(FILE *) libcesque;
-int feof_unlocked(FILE *) libcesque;
-int ferror_unlocked(FILE *) libcesque;
-int fileno_unlocked(FILE *) libcesque;
-int fflush_unlocked(FILE *) libcesque;
-int fgetc_unlocked(FILE *) libcesque;
-int fputc_unlocked(int, FILE *) libcesque;
-size_t fread_unlocked(void *, size_t, size_t, FILE *) libcesque;
-size_t fwrite_unlocked(const void *, size_t, size_t, FILE *) libcesque;
-char *fgets_unlocked(char *, int, FILE *) libcesque;
-int fputs_unlocked(const char *, FILE *) libcesque;
-wint_t getwc_unlocked(FILE *) libcesque;
+void clearerr_unlocked(FILE *) libcesque __write_only(1);
+int feof_unlocked(FILE *) libcesque __read_only(1);
+int ferror_unlocked(FILE *) libcesque __read_only(1);
+int fileno_unlocked(FILE *) libcesque __read_only(1);
+int fflush_unlocked(FILE *) libcesque __read_write(1);
+int fgetc_unlocked(FILE *) libcesque __read_write(1);
+int fputc_unlocked(int, FILE *) libcesque __read_write(2);
+size_t fread_unlocked(void *, size_t, size_t, FILE *) libcesque __write_only(1) __read_write(4);
+size_t fwrite_unlocked(const void *, size_t, size_t, FILE *) libcesque __read_only(1) __read_write(4);
+char *fgets_unlocked(char *, int, FILE *) libcesque __write_only(1) __read_write(3);
+int fputs_unlocked(const char *, FILE *) libcesque __read_only(1) __read_write(2);
+wint_t getwc_unlocked(FILE *) libcesque __read_write(1);
 wint_t getwchar_unlocked(void) libcesque;
-wint_t fgetwc_unlocked(FILE *) libcesque;
-wint_t fputwc_unlocked(wchar_t, FILE *) libcesque;
-wint_t putwc_unlocked(wchar_t, FILE *) libcesque;
+wint_t fgetwc_unlocked(FILE *) libcesque __read_write(1);
+wint_t fputwc_unlocked(wchar_t, FILE *) libcesque __read_write(2);
+wint_t putwc_unlocked(wchar_t, FILE *) libcesque __read_write(2);
 wint_t putwchar_unlocked(wchar_t) libcesque;
-wchar_t *fgetws_unlocked(wchar_t *, int, FILE *) libcesque;
-int fputws_unlocked(const wchar_t *, FILE *) libcesque;
-wint_t ungetwc_unlocked(wint_t, FILE *) libcesque paramsnonnull();
-int ungetc_unlocked(int, FILE *) libcesque paramsnonnull();
-int fseek_unlocked(FILE *, int64_t, int) libcesque paramsnonnull();
-ssize_t getdelim_unlocked(char **, size_t *, int, FILE *) paramsnonnull();
-int fprintf_unlocked(FILE *, const char *, ...) printfesque(2) libcesque;
-int vfprintf_unlocked(FILE *, const char *, va_list) paramsnonnull() libcesque;
+wchar_t *fgetws_unlocked(wchar_t *, int, FILE *) libcesque __write_only(1, 2) __read_write(3);
+int fputws_unlocked(const wchar_t *, FILE *) libcesque __read_only(1) __read_write(2);
+wint_t ungetwc_unlocked(wint_t, FILE *) libcesque paramsnonnull() __read_write(2);
+int ungetc_unlocked(int, FILE *) libcesque paramsnonnull() __read_write(2);
+int fseek_unlocked(FILE *, int64_t, int) libcesque paramsnonnull() __read_write(1);
+ssize_t getdelim_unlocked(char **, size_t *, int, FILE *) paramsnonnull() __read_write(1) __read_write(2) __read_write(4);
+int fprintf_unlocked(FILE *, const char *, ...) printfesque(2) libcesque __read_write(1) __read_only(2);
+int vfprintf_unlocked(FILE *, const char *, va_list) paramsnonnull() libcesque __read_write(1) __read_only(2);
 
 COSMOPOLITAN_C_END_
 #endif /* COSMOPOLITAN_LIBC_STDIO_H_ */

libc/stdio/vasprintf.c

@@ -52,6 +52,7 @@ int vasprintf(char **strp, const char *fmt, va_list va) {
     *strp = p;
     return rc;
   } else {
+    free(p);
     return -1;
   }
 }

libc/stdio/vcscanf.c

@@ -254,11 +254,15 @@ int __vcscanf(int callback(void *),    //
                 c = READ;
               }
               fpbufsize = FP_BUFFER_GROW;
-              fpbuf = malloc(fpbufsize);
-              fpbufcur = 0;
-              fpbuf[fpbufcur++] = c;
-              fpbuf[fpbufcur] = '\0';
-              goto ConsumeFloatingPointNumber;
+              if ((fpbuf = malloc(fpbufsize))) {
+                fpbufcur = 0;
+                fpbuf[fpbufcur++] = c;
+                fpbuf[fpbufcur] = '\0';
+                goto ConsumeFloatingPointNumber;
+              } else {
+                items = -1;
+                goto Done;
+              }
             default:
               items = einval();
               goto Done;
@@ -513,12 +517,16 @@ int __vcscanf(int callback(void *),    //
         if (discard) {
           buf = NULL;
         } else if (ismalloc) {
-          buf = malloc(bufsize * charbytes);
-          struct FreeMe *entry;
-          if (buf && (entry = calloc(1, sizeof(struct FreeMe)))) {
-            entry->ptr = buf;
-            entry->next = freeme;
-            freeme = entry;
+          if ((buf = malloc(bufsize * charbytes))) {
+            struct FreeMe *entry;
+            if (buf && (entry = calloc(1, sizeof(struct FreeMe)))) {
+              entry->ptr = buf;
+              entry->next = freeme;
+              freeme = entry;
+            }
+          } else {
+            items = -1;
+            goto Done;
           }
         } else {
           buf = va_arg(va, void *);

libc/str/str.h

@@ -26,10 +26,10 @@ COSMOPOLITAN_C_START_
 
 void *memset(void *, int, size_t) memcpyesque;
 void *memmove(void *, const void *, size_t) memcpyesque;
-void *memcpy(void *restrict, const void *restrict, size_t) memcpyesque;
-void *mempcpy(void *restrict, const void *restrict, size_t) memcpyesque;
-char *hexpcpy(char *restrict, const void *restrict, size_t) memcpyesque;
-void *memccpy(void *restrict, const void *restrict, int, size_t) memcpyesque;
+void *memcpy(void *, const void *, size_t) memcpyesque;
+void *mempcpy(void *, const void *, size_t) memcpyesque;
+char *hexpcpy(char *, const void *, size_t) memcpyesque;
+void *memccpy(void *, const void *, int, size_t) memcpyesque;
 void explicit_bzero(void *, size_t);
 
 int memcmp(const void *, const void *, size_t) strlenesque;
@@ -173,16 +173,11 @@ char *__join_paths(char *, size_t, const char *, const char *) libcesque __wur;
 int __mkntpathat(int, const char *, int, char16_t[hasatleast 1024]);
 #endif /* _COSMO_SOURCE */
 
-#if defined(_COSMO_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE) || \
-    defined(_POSIX_SOURCE) ||                                                 \
-    (defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE + 0 < 200809L) ||            \
-    (defined(_XOPEN_SOURCE) && _XOPEN_SOURCE + 0 < 700)
 int bcmp(const void *, const void *, size_t) strlenesque;
 void bcopy(const void *, void *, size_t) memcpyesque;
 void bzero(void *, size_t) memcpyesque;
 char *index(const char *, int) strlenesque;
 char *rindex(const char *, int) strlenesque;
-#endif
 
 COSMOPOLITAN_C_END_
 #endif /* !(__ASSEMBLER__ + __LINKER__ + 0) */