/*
 * This file and its contents are supplied under the terms of the
 * Common Development and Distribution License ("CDDL"), version 1.0.
 * You may only use this file in accordance with the terms of version
 * 1.0 of the CDDL.
 *
 * A full copy of the text of the CDDL should have accompanied this
 * source.  A copy of the CDDL is also available via the Internet at
 * http://www.illumos.org/license/CDDL.
 */

/*
 * Copyright 2026 Oxide Computer Company
 */

/*
 * Tests for the raw spawn(2) system call interface. These concentrate
 * mainly on checking that the kernel fully validates the marshalled
 * spawn_param_t/spawn_args_t structures that libc constructs.
 * We also test that a spawned child is robust against being killed in
 * the window between creation and exec.
 *
 * Functional coverage of posix_spawn(3C) itself (attributes, file actions,
 * PATH handling, etc.) lives in libc-tests/tests/posix_spawn.
 */

#include <errno.h>
#include <signal.h>
#include <spawn.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/spawn_impl.h>
#include <sys/types.h>
#include <sys/wait.h>

static uint_t failures = 0;

#define TFAIL(name, fmt, ...)   do {                                    \
        (void) fprintf(stderr, "TEST FAILED: %s: " fmt "\n",            \
            (name), ##__VA_ARGS__);                                     \
        failures++;                                                     \
} while (0)

#define TPASS(name)     (void) printf("TEST PASSED: %s\n", (name))

/*
 * The spawn_args_t and spawn_param_t structures end in a variable-length
 * data[] region. These tests build small instances on the stack and reserve a
 * fixed amount of room for that region.
 */
#define SA_DATA 16
#define SP_DATA 64

static pid_t
raw_spawn(const char *path, const void *sp, uint32_t spsize, const void *sa,
    uint32_t sasize)
{
        return (syscall(SYS_spawn, path, sp, spsize, sa, sasize));
}

/*
 * Build a minimal valid spawn_args_t in the provided buffer:
 * argv = { "x" }, empty environment.
 */
static uint32_t
valid_args(spawn_args_t *sa)
{
        uint32_t sasize = sizeof (*sa) + 2;

        (void) memset(sa, 0, sasize);
        sa->sa_size = sasize;
        sa->sa_datalen = 2;
        sa->sa_arg_cnt = 1;
        sa->sa_env_off = 2;
        sa->sa_data[0] = 'x';
        sa->sa_data[1] = '\0';

        return (sasize);
}

static const char *
errname(int err)
{
        const char *name = strerrorname_np(err);

        return (name != NULL ? name : "?");
}

static void
expect_err(const char *name, int wanted, const char *path, const void *sp,
    uint32_t spsize, const void *sa, uint32_t sasize)
{
        pid_t pid = raw_spawn(path, sp, spsize, sa, sasize);

        if (pid != -1) {
                TFAIL(name, "spawn unexpectedly succeeded (pid %d)",
                    (int)pid);
                (void) waitpid(pid, NULL, 0);
                return;
        }
        if (errno != wanted) {
                TFAIL(name, "got %s (%d), wanted %s (%d)", errname(errno),
                    errno, errname(wanted), wanted);
                return;
        }
        TPASS(name);
}

/*
 * The positive case: a well-formed minimal request - a valid argument vector,
 * no spawn parameters and no file actions - succeeds, and the child
 * (/usr/bin/true) exits 0.
 */
static void
t_valid(void)
{
        union {
                spawn_args_t sa;
                char pad[sizeof (spawn_args_t) + SA_DATA];
        } au;
        uint32_t sasize = valid_args(&au.sa);
        int status;
        pid_t pid;

        pid = raw_spawn("/usr/bin/true", NULL, 0, &au.sa, sasize);
        if (pid == -1) {
                TFAIL("valid", "spawn failed: %s", strerror(errno));
                return;
        }
        if (waitpid(pid, &status, 0) != pid) {
                TFAIL("valid", "waitpid: %s", strerror(errno));
                return;
        }
        if (!WIFEXITED(status) || WEXITSTATUS(status) != 0) {
                TFAIL("valid", "status %#x", status);
                return;
        }
        TPASS("valid, well-formed, minimal spawn request");
}

static void
t_args_fuzz(void)
{
        union {
                spawn_args_t sa;
                char pad[sizeof (spawn_args_t) + SA_DATA];
        } au;
        spawn_args_t *sa = &au.sa;
        uint32_t sasize;

        expect_err("null-path", EINVAL, NULL, NULL, 0, &au.sa,
            valid_args(&au.sa));
        expect_err("null-args", EINVAL, "/usr/bin/true", NULL, 0, NULL, 0);

        sasize = valid_args(sa);
        sa->sa_size = sasize + 8;
        expect_err("args-size-mismatch", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sasize);

        sasize = valid_args(sa);
        sa->sa_datalen = 1;
        expect_err("args-datalen-mismatch", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sasize);

        sasize = valid_args(sa);
        sa->sa_arg_cnt = 100;
        expect_err("args-cnt-overrun", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sasize);

        sasize = valid_args(sa);
        sa->sa_data[1] = 'y';   /* string no longer NUL-terminated */
        expect_err("args-unterminated", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sasize);

        sasize = valid_args(sa);
        sa->sa_env_off = 100;
        expect_err("args-env-off", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sasize);

        sasize = valid_args(sa);
        sa->sa_env_cnt = 7;
        expect_err("args-env-cnt", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sasize);

        sasize = valid_args(sa);
        expect_err("args-e2big", E2BIG, "/usr/bin/true", NULL, 0,
            sa, 0x400000);

        /* Truncated buffer: shorter than the header itself. */
        sasize = valid_args(sa);
        expect_err("args-short", EINVAL, "/usr/bin/true", NULL, 0,
            sa, sizeof (*sa) - 4);
}

static void
t_param_fuzz(void)
{
        union {
                spawn_args_t sa;
                char pad[sizeof (spawn_args_t) + SA_DATA];
        } au;
        union {
                spawn_param_t sp;
                char pad[sizeof (spawn_param_t) + SP_DATA];
        } pu;
        spawn_param_t *sp = &pu.sp;
        uint32_t sasize = valid_args(&au.sa);
        uint32_t spsize = sizeof (*sp) + SP_DATA;
        kfile_attr_t *kfa;

        /* Size field disagreeing with the system call argument. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize + 4;
        sp->sp_datalen = SP_DATA;
        expect_err("param-size-mismatch", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Attribute region out of bounds. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_attr_off = 60;
        sp->sp_attr_len = sizeof (spawn_attr_t);
        expect_err("param-attr-off", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Attribute length that is not sizeof (spawn_attr_t). */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_attr_len = 8;
        expect_err("param-attr-len", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Undefined attribute flags. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_attr_off = 0;
        sp->sp_attr_len = sizeof (spawn_attr_t);
        ((spawn_attr_t *)&sp->sp_data[0])->sa_psflags = ~0;
        expect_err("param-attr-flags", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* File action record with a zero length. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_fattr_cnt = 2;
        expect_err("param-fattr-len", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* File action record with a bad type. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_fattr_cnt = 1;
        kfa = (kfile_attr_t *)&sp->sp_data[0];
        kfa->kfa_len = sizeof (*kfa);
        kfa->kfa_type = 666;
        expect_err("param-fattr-type", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* FA_CHDIR with an unterminated path. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_fattr_cnt = 1;
        kfa = (kfile_attr_t *)&sp->sp_data[0];
        kfa->kfa_type = FA_CHDIR;
        kfa->kfa_pathsize = 4;
        kfa->kfa_len = sizeof (*kfa) + 4;
        (void) memcpy(kfa->kfa_path, "/tmp", 4);        /* no NUL */
        expect_err("param-chdir-nul", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Unterminated shell and search path strings. */
        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_shell_off = 0;
        sp->sp_shell_len = 4;
        (void) memcpy(sp->sp_data, "/bin", 4);
        expect_err("param-shell-nul", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        (void) memset(&pu, 0, sizeof (pu));
        sp->sp_size = spsize;
        sp->sp_datalen = SP_DATA;
        sp->sp_path_off = 62;
        sp->sp_path_len = 8;
        expect_err("param-path-off", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        expect_err("param-e2big", E2BIG, "/usr/bin/true",
            sp, 0x400000, &au.sa, sasize);

        expect_err("param-short", EINVAL, "/usr/bin/true",
            sp, sizeof (*sp) - 4, &au.sa, sasize);
}

/*
 * Build a spawn_param_t carrying an attribute region with
 * POSIX_SPAWN_SETSCHEDPARAM set and a scheduling region with the given
 * operation.
 */
static kspawn_sched_t *
valid_sched(spawn_param_t *sp, uint32_t spsize, int op)
{
        spawn_attr_t *spa;
        kspawn_sched_t *ks;

        (void) memset(sp, 0, spsize);
        sp->sp_size = spsize;
        sp->sp_datalen = spsize - sizeof (*sp);
        sp->sp_attr_off = 0;
        sp->sp_attr_len = sizeof (spawn_attr_t);
        spa = (spawn_attr_t *)&sp->sp_data[0];
        spa->sa_psflags = POSIX_SPAWN_SETSCHEDPARAM;
        sp->sp_sched_off = sizeof (spawn_attr_t);
        sp->sp_sched_len = sizeof (kspawn_sched_t);
        ks = (kspawn_sched_t *)&sp->sp_data[sp->sp_sched_off];
        ks->ksched_op = op;

        return (ks);
}

static void
t_sched_fuzz(void)
{
        union {
                spawn_args_t sa;
                char pad[sizeof (spawn_args_t) + SA_DATA];
        } au;
        union {
                spawn_param_t sp;
                char pad[sizeof (spawn_param_t) + 128];
        } pu;
        spawn_param_t *sp = &pu.sp;
        uint32_t sasize = valid_args(&au.sa);
        uint32_t spsize = sizeof (*sp) + 128;
        kspawn_sched_t *ks;

        /* Scheduling flag set but no scheduling region. */
        (void) valid_sched(sp, spsize, KSCHED_PARMS);
        sp->sp_sched_off = sp->sp_sched_len = 0;
        expect_err("sched-missing", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Scheduling region present without a scheduling flag. */
        (void) valid_sched(sp, spsize, KSCHED_PARMS);
        ((spawn_attr_t *)&sp->sp_data[0])->sa_psflags = 0;
        expect_err("sched-no-flags", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Scheduling region with the wrong length. */
        (void) valid_sched(sp, spsize, KSCHED_PARMS);
        sp->sp_sched_len = 8;
        expect_err("sched-len", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Scheduling region out of bounds. */
        (void) valid_sched(sp, spsize, KSCHED_PARMS);
        sp->sp_sched_off = sp->sp_datalen - 4;
        expect_err("sched-off", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* Invalid operation. */
        (void) valid_sched(sp, spsize, 0);
        expect_err("sched-op", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /* A priority change must be a set operation. */
        ks = valid_sched(sp, spsize, KSCHED_PRIO);
        ks->ksched_prio.pc_op = PC_GETPRIO;
        ks->ksched_prio.pc_cid = 1;
        expect_err("sched-prio-op", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        /*
         * Class IDs out of range. These are not caught until the child
         * applies the attributes to itself, exercising the error handshake.
         */
        ks = valid_sched(sp, spsize, KSCHED_PRIO);
        ks->ksched_prio.pc_op = PC_SETPRIO;
        ks->ksched_prio.pc_cid = 999;
        expect_err("sched-prio-cid", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);

        ks = valid_sched(sp, spsize, KSCHED_PARMS);
        ks->ksched_parms.pc_cid = 999;
        expect_err("sched-parms-cid", EINVAL, "/usr/bin/true",
            sp, spsize, &au.sa, sasize);
}

/*
 * A child killed immediately after spawn(2) returns must be waitable and
 * must never leave the parent stuck. We try a few times to give us a fighting
 * chance of catching it.
 */
static void
t_kill_race(void)
{
        union {
                spawn_args_t sa;
                char pad[sizeof (spawn_args_t) + SA_DATA];
        } au;
        uint32_t sasize = valid_args(&au.sa);

        /*
         * Spawn a child and immediately kill it, over and over, to exercise
         * the window between creation and exec. valid_args() supplies only
         * argv[0], so sleep runs with no duration. That does not matter,
         * because we SIGKILL it at once - all we need is a live PID to race
         * against.
         */
        for (int i = 0; i < 100; i++) {
                int status;
                pid_t pid;

                pid = raw_spawn("/usr/bin/sleep", NULL, 0, &au.sa, sasize);
                if (pid == -1) {
                        TFAIL("kill-race", "spawn failed: %s",
                            strerror(errno));
                        return;
                }
                (void) kill(pid, SIGKILL);
                if (waitpid(pid, &status, 0) != pid) {
                        TFAIL("kill-race", "waitpid: %s", strerror(errno));
                        return;
                }
                if (!WIFSIGNALED(status) &&
                    !(WIFEXITED(status) && WEXITSTATUS(status) != 0)) {
                        TFAIL("kill-race", "iteration %d: status %#x",
                            i, status);
                        return;
                }
        }
        TPASS("kill-race");
}

int
main(void)
{
        t_valid();
        t_args_fuzz();
        t_param_fuzz();
        t_sched_fuzz();
        t_kill_race();

        if (failures == 0) {
                (void) printf("All tests passed\n");
                return (EXIT_SUCCESS);
        }

        (void) fprintf(stderr, "%u test(s) failed\n", failures);
        return (EXIT_FAILURE);
}