sys/sys: remove CONSTCOND comment from do-while-0 loop

Lint doesn't need this comment anymore, as there is nothing surprising
or unusual about this idiom.

sys/cdefs.h: Make various macros work more robustly.

Use predefined __-namespace macros inside __BIT, __type_min,
__type_max, and __type_fit:

- Use __CHAR_BIT__ instead of NBBY so this works without sys/types.h
and without _NETBSD_SOURCE.

- Use __INTMAX_TYPE__, __UINTMAX_TYPE__ instead of intmax_t, uintmax_t
so this works without stdint.h.

No functional change intended.

sys/cdefs.h: pass __aligned to lint

Lint could parse _Alignas and __attribute__((__aligned__(4))) previously
but simply ignored them. Since today, they affect the layout of struct
and union.

sys/cdefs.h: New __MACROUSE for macros to type-check arguments.

This way, if there's a macro F(x) with a conditional definition --
e.g., conditional on DIAGNOSTIC or KDTRACE_HOOKS -- it can do
__MACROUSE(x) in the definition that's supposed to compile away,
without triggering `variable set but not used' errors, while still
catching type errors in the expression x. But there's no cost or
side effects incurred in the generated code because the value is not
computed.

This should be the same as __USE, but I haven't figured out how to
make it work for both bit fields (which are likely to appear in macro
arguments) and aggregates (structs/unions, which are likely to appear
as variable declarations), so for now we use two separate macros.

Add __MASK(3)

__MASK(n): first n bits all set, where __MASK(4) == 0b1111.

don't gut restrict for lint.

Provide __CONCATn macros that take from 3 to 8 arguments and concatenate
them.

I didn't provide the non-STDC versions

remove unused "_DIAGNOSTIC" option and opt_diagnostic.h.
note that this is unrelated to the widely used "DIAGNOSTIC" option.

add __null_sentinel (from FreeBSD)

branches: 1.154.2;
For NO_KERNEL_RCSIDS, strip __RCSID() also for src/common/*.

Don't use typedef at all for __CTASSERT1.

Fix __CTASSERT1() in sys/cdefs.h for recent Clang/LLVM

Clang now implements a restriction on giving non-C-compatible anonymous
structs a typedef name for linkage purposes, as described in C++ committee
paper `P1766R1 <http://wg21.link/p1766r1>'.

https://reviews.llvm.org/D74103

branches: 1.151.2;
Expand the support of __no[sanitizer] attributes

Add support for RUMPKERNEL that can reuse these attributes in the same code.
These macros are not intended to be used by userland and are still disabled
there. They are a NetBSD specific extension.

Add proper support for clang and GCC.

Set __no[sanitizer] only under a sanitizer, as otherwise there are build
warnings about unused compiler attributes.

Reviewed by <maxv>

Fix __nomsan: missing opt_kmsan.h, and the attribute should be
kernel-memory.

Add support for Kernel Memory Sanitizer (kMSan). It detects uninitialized
memory used by the kernel at run time, and just like kASan and kCSan, it
is an excellent feature. It has already detected 38 uninitialized variables
in the kernel during my testing, which I have since discreetly fixed.

We use two shadows:
- "shad", to track uninitialized memory with a bit granularity (1:1).
Each bit set to 1 in the shad corresponds to one uninitialized bit of
real kernel memory.
- "orig", to track the origin of the memory with a 4-byte granularity
(1:1). Each uint32_t cell in the orig indicates the origin of the
associated uint32_t of real kernel memory.

The memory consumption of these shadows is consequent, so at least 4GB of
RAM is recommended to run kMSan.

The compiler inserts calls to specific __msan_* functions on each memory
access, to manage both the shad and the orig and detect uninitialized
memory accesses that change the execution flow (like an "if" on an
uninitialized variable).

We mark as uninit several types of memory buffers (stack, pools, kmem,
malloc, uvm_km), and check each buffer passed to copyout, copyoutstr,
bwrite, if_transmit_lock and DMA operations, to detect uninitialized memory
that leaves the system. This allows us to detect kernel info leaks in a way
that is more efficient and also more user-friendly than KLEAK.

Contrary to kASan, kMSan requires comprehensive coverage, ie we cannot
tolerate having one non-instrumented function, because this could cause
false positives. kMSan cannot instrument ASM functions, so I converted
most of them to __asm__ inlines, which kMSan is able to instrument. Those
that remain receive special treatment.

Contrary to kASan again, kMSan uses a TLS, so we must context-switch this
TLS during interrupts. We use different contexts depending on the interrupt
level.

The orig tracks precisely the origin of a buffer. We use a special encoding
for the orig values, and pack together in each uint32_t cell of the orig:
- a code designating the type of memory (Stack, Pool, etc), and
- a compressed pointer, which points either (1) to a string containing
the name of the variable associated with the cell, or (2) to an area
in the kernel .text section which we resolve to a symbol name + offset.

This encoding allows us not to consume extra memory for associating
information with each cell, and produces a precise output, that can tell
for example the name of an uninitialized variable on the stack, the
function in which it was pushed on the stack, and the function where we
accessed this uninitialized variable.

kMSan is available with LLVM, but not with GCC.

The code is organized in a way that is similar to kASan and kCSan, so it
means that other architectures than amd64 can be supported.

Add Kernel Concurrency Sanitizer (kCSan) support. This sanitizer allows us
to detect race conditions at runtime. It is a variation of TSan that is
easy to implement and more suited to kernel internals, albeit theoretically
less precise than TSan's happens-before.

We do basically two things:

- On every KCSAN_NACCESSES (=2000) memory accesses, we create a cell
describing the access, and delay the calling CPU (10ms).

- On all memory accesses, we verify if the memory we're reading/writing
is referenced in a cell already.

The combination of the two means that, if for example cpu0 does a read that
is selected and cpu1 does a write at the same address, kCSan will fire,
because cpu1's write collides with cpu0's read cell.

The coverage of the instrumentation is the same as that of kASan. Also, the
code is organized in a way similar to kASan, so it is easy to add support
for more architectures than amd64. kCSan is compatible with KCOV.

Reviewed by Kamil.

Add and use __FPTRCAST, requested by uwe@

Handle LSan/LLVM and LSan/GCC in __NO_LEAKS

__has_feature(leak_sanitizer) was merged with Clang/LLVM today:
https://reviews.llvm.org/D67719

GCC specific ifdef __SANITIZE_LEAK__ is pending in upstream review...
https://gcc.gnu.org/ml/gcc-patches/2019-09/msg01270.html and can be
rejected as GCC upstream does not see value in feature parity with LLVM
sanitizers. For the time being this will be a NetBSD specific extension.

Make __CTASSERT static assert again

Today GCC/Clang allow to specify typedef char[] with the dynamic VLA
property (as introduced in C99). This means that __CTASSERT(), when
misused with run-time semantics, was a dummy check generating either
1 or -1 size of typedef char[].

It was caught in runtime by kUBSan as -1 is size of VLA with unspecified
semantics in runtime (Undefined Behavior).

Use bit-field to enforce compile-time constant.

This approach has been inspired by the Perl variation of static_assert().

Define __noubsan in sys/cdefs.h for KERNEL sanitization

Define __NO_LEAKS in sys/cdefs.h

This preprocessor symbol is intended to be used with leak detecting
software, documenting leaks that are not important to be freed in the
default build version.

Add Clang/LLVM specific feature/extension detection macros in sys/cdefs.h

These macros are not supported (as of now) with GCC and there is need to
maintain a fallback that evaluates to 0.

add a lint(1) comment to nothing.

lint understands attributes.

Appease gcc error: comparison of unsigned expression < 0 is always false
when using __BITS(u_int, 0)

Stop mangling __func__ for C++11 and newer

Drop local logic between GCC 2.4 and GCC 2.6 that used __PRETTY_FUNCTION__.
This caused __func__ to be redefined for all C++ programs and use a
different behavior than intended by the compiler (Clang and GCC).
__PRETTY_FUNCTION__ prints all the prototype not just function name,
contrary to __FUNCTION__ and __func__.

__func__ is now an integral part of C99 and C++11, shipped by a compiler.

This change aligns the behavior of C++ programs using __func__ to other
Operating Systems. The difference caused unnecessary fallout in regression
test suites in projects (LLVM, fish, ...).

Add support for monitoring the stack with kASan. This allows us to detect
illegal memory accesses occuring there.

The compiler inlines a piece of code in each function that adds redzones
around the local variables and poisons them. The illegal accesses are then
detected using the usual kASan machinery.

The stack size is doubled, from 4 pages to 8 pages.

Several boot functions are marked with the __noasan flag, to prevent the
compiler from adding redzones in them (because we haven't yet initialized
kASan). The kasan_early_init function is called early at boot time to
quickly create the shadow for the current stack; after this is done, we
don't need __noasan anymore in the boot path.

We pass -fasan-shadow-offset=0xDFFF900000000000, because the compiler
wants to do
shad = shadow-offset + (addr >> 3)
and we do, in kasan_addr_to_shad
shad = KASAN_SHADOW_START + ((addr - CANONICAL_BASE) >> 3)
hence
shad = KASAN_SHADOW_START + (addr >> 3) - (CANONICAL_BASE >> 3)
= [KASAN_SHADOW_START - (CANONICAL_BASE >> 3)] + (addr >> 3)
implies
shadow-offset = KASAN_SHADOW_START - (CANONICAL_BASE >> 3)
= 0xFFFF800000000000 - (0xFFFF800000000000 >> 3)
= 0xDFFF900000000000

In UVM, we add a kasan_free (that is not preceded by a kasan_alloc). We
don't add poisoned redzones ourselves, but all the functions we execute
do, so we need to manually clear the poison before freeing the stack.

With the help of Kamil for the makefile stuff.

Remove dependency of __BITS on MAX/MIN by providing __MAX/__MIN

branches: 1.135.2; 1.135.4;
add linted to __USE()

lint knows about all inline variant syntax...

branches: 1.133.2;
Ignore __thread for lint for now

branches: 1.132.6;
use __nothing instead since __empty is taken in stl_deque.h

remove comment in comment

add __empty

branches: 1.129.2;
Our lint knows about attributes, stop eating them.

branches: 1.128.2;
long line police

introduce a __syslog__ format, and __sysloglike() macros. If __syslog__
is not available, this fails back to __printf__

wishful thinking?

Include opt_diagnostic.h.

add constcond

add cast-through-void * macros

branches: 1.122.2;
Don't use or in __RENAME because it triggers -Wc++-compat

Add __unreachable(), which can be used to mark dead branches when the
compiler can't tell side effects.

remove PCC specific definitions for __packed, __aligned and __section
which result in a _Pragma() usage. I don't think this ever worked,
as you can't concatenate string literals in this way. A warning
would have been produced, but until recently did not result in an
error condition so this was overlooked. Use __attribute__ instead as
this is supported by PCC.

branches: 1.119.2;
For compilers without __COUNTER__, make the ctassert name contain
__INCLUDE_LEVEL__ ## _ ## __LINE__. It's not perfect, but at least it's
better than just __LINE__ since it avoids collisions between .c's and .h's.

Incidentally, why does half of the kernel call CTASSERT() and the
other half __CTASSERT()?

Add another set of parens

mask the shift by __n with NBBY*sizeof(uintmax-t)-1
to suppress the following diagnostic from clang:
error: shift count >= width of type [-Werror,-Wshift-count-overflow]
PAR_ATTR = __BITS(63,56),// F=0 memory attributes
^~~~~~~~~~~~~
src/sys/sys/cdefs.h:554:4: note: expanded from macro '__BITS'
((__BIT(MAX((__m), (__n)) + 1) - 1) ^ (__BIT(MIN((__m), (__n))) - 1))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/sys/sys/cdefs.h:550:73: note: expanded from macro '__BIT'
(((uintmax_t)(__n) >= NBBY * sizeof(uintmax_t)) ? 0 : ((uintmax_t)1 << (uintmax_t)(__n)))
^ ~~~~~~~~~~~~~~~~

Now that these attributes are documented in attribute(3), shorten
the comments for __used, __unused, __diagused, and __debugused.
Also s/variable/item/ because the attributes may bve applied
to functions.

Add __diagused and __debugused. These are for marking variables that
are used only in diagnotic or debug code, but unused when NDEBUG is
defined, or DIAGNOSTIC is not defined, or DEBUG is not defined.

Add comments explaining what __unused and __used are for.

introduce __USE(variable) that uses a variable to squash unused variable
warnings.

Remove __CT_LOCAL_PROLOGUE/EPILOGUE hack - instead just mark the typedef
as __unused. Duh!

Define a prologue/epilogue for CTASSERTs using local variables (to avoid
warnings about decalarations of localy defined but unused types)

Unbreak vax build (which still uses gcc 4.1). See PR lib/48131.

Implement __negative_p without floating-point arithmetic, using
a solution proposed by jxh on Stack Overflow. Fixes the second
half of PR lib/48131.

While there, simplify __type_fit_u by using the same logic
as in __type_fit_s.

ok christos@

Check for overflow in __type_fit_s when casting to intmax_t.
Fixes the first half of PR lib/48131.

ok christos@

branches: 1.107.2;
While visibility "protected" is nominaly supported by gcc 4.0 and 4.1
it does not actually work - the compiler does not emmit ".protected"
asm statements for used references to protected symbols, which then
causes the linker to fail and/or produce unloadable libraries.
This recently happened to port vax by the locale changes.

Backporting a fix (ASM_OUTPUT_EXTERNAL in gcc target config) is not
feasible.

So: define __dso_protected only starting with gcc 4.2.

Add protected visibility marker for things that we want to keep public
for historical ABI issues, but that are not allowed to be overriden.

Fix comment documenting __link_set_decl() macro.

The `__link_set_decl()` macro's replacement text includes a `*` after
`ptype`, so `ptype` is the pointed-at type (the type of a dereferenced
array entry), not the pointer type.

(This is a comment-only change.)

(From Richard Hansen of BBN.)

Don't define __BIT/__BITS if __ASSEMBLER__ is defined.
(since they use C syntax they won't work anyways).

For GCC 4.1 and later, use the __alignof__ keyword.

define __alignof() in terms of __alignof__ if it is available.

Add an __alignof() macro.

branches: 1.100.2;
use #elif rather than nesting #elses

Add a __always_inline

Fix a (obvious) typo

remove extra ;

add constcond

use __inline to fix nspr's configure issue

- this file is still used from assembly. protect inlines against __ASSEMBLER__
- rename __zero -> __zeroll, __negative -> __negative_p

Type macros providing min and max values for the given type, plus one that
returns if a value can be represented in a given type.

Backout previous - we do not need it anymore

There are some places where C99 allows a restrict modifier (and posix
demands it), but C++ does not allow it. So add a C only version of
__restrict, which expands to nothing if compiling C++.
See http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49347 for a discussion.

PR 46040:
If the current compiler doesn't support C99, check if it is compatible
with GCC 2.92. In that case, use the protected __restricted__ form.
In any other case, default to removing __restricted.

branches: 1.89.4; 1.89.6;
Add __returns_twice for the attribute of the same name. This makes the
attribute explicit based on the functions GCC gives it too.

branches: 1.88.2;
add __noclone for gcc 4.5.

Add __strict_weak_alias(), the type-safe alternative to __weak_alias().

Added __packed define to be able to use eMbedded Visual C++ for building hpcboot.exe.

Add an optional MD calling convention flag for use in libsa when space
optimisation is critical. Use this on i386 to switch to register passing
calling convention for the file system entry points and most assembler
call backs that have to preserve at least 3 registers.

branches: 1.84.2;
Make __CTASSERT use __COUNTER__ instead of __LINE__ if the cpp supports it.

Add __CTASSERT(x)

Add a __noprofile keyword to disable the profiling of a function.

branches: 1.81.2; 1.81.4;
Rename __BEGIN_PUBLIC / __BEGIN_HIDDEN to __BEGIN_PUBLIC_DECLS /
__BEGIN_HIDDEN_DECLS and corresponding __END_* macros. Push the extern
"C" logic into __BEGIN_PUBLIC_DECLS / __BEGIN_HIDDEN_DECLS to make them
easier to use in header files used by C++.

Add __BEGIN_PUBLIC / __END_PUBLIC, __BEGIN_HIDDEN / __END_HIDDEN and
__dso_public and __dso_hidden markers. Change __BEGIN_DECLS /
__END_DECLS to include __BEGIN_PUBLIC / __END_PUBLIC.

Define a new __c99inline macro for compilers known to implement the C99
behavior. This unbreaks GCC 4.4's libgfortran build with the old
signal.h logic, because GCC decided to put the body for the sigsetop
functions in multiple objects.

branches: 1.78.2; 1.78.4;
lint knows __packed now.

Create and use __CAST(type, value) in headers so that modern c++ with
-Wold-style-casts does not bitch.

Add __constfunc and explain how it differs from __pure.

Fix _packed attribute for PCC. According to Ragge it should be _Pragma("packed
1") instead of _Pragma("packed").

With this fix userland programs needing _packed will now work.

Cast the argument of the __BIT to an unsigned type, since it does not make
sense for it to be signed and gcc complains if it is.

Pass argument to __aligned() through __STRING() so that it is correctly expanded. Now __aligned(CACHE_LINE_SIZE) works with pcc.

branches: 1.72.2;
As promised in the commit message, revert previous. __RENAME() is
not required by rumpkernel.

Allow __RENAME if _RUMPKERNEL
(although I'll probably revert this soon, but add it now to allow build)

Add the __printflike(), __scanflike() and __format_arg() macros, from FreeBSD

They will be used soon by the Atheros HAL code, many other places can use them
to avoid GCC dependency.

branches: 1.69.2; 1.69.10; 1.69.14;
Add __packed and __aligned support for PCC.
Define away restrict for __lint__.

branches: 1.68.2;
pcc now supports __section().

branches: 1.67.2;
Add a __noinline attribute. Suggested by christos@.

branches: 1.66.14; 1.66.16; 1.66.18; 1.66.20;
Separate handling of __attribute__, __dead and __pure:
- define away __attribute__ if not running GCC or running GCC < 2.0.
- use __attribute__((__return__)) for GCC >= 2.5, keep other cases.
- use __attribute__((__pure__)) for GCC >= 29.6, keep other cases.

branches: 1.65.6;
Add basic defines to be able to use pcc as compiler (renaming etc).

branches: 1.64.8; 1.64.22; 1.64.24;
Cosmetic: join lines.

Stop using typeof() in the bit-twiddling macros, per yamt@'s
suggestion. This change requires that I use the __PRIuBITS format
string in atw and rtw, so do that.

Define __used as __unused for gcc's that don't grok __attribute__((__used__))

Those older versions of gcc don't eliminate unused functions/vars
anyway, so it's enough just to suppress the warning.

branches: 1.61.2; 1.61.4;
Per discussion on tech-kern and tech-userlevel, move the bit-twiddling
macros, __BIT, __BITS, SHIFTIN, SHIFTOUT, and __arraycount() from
lib/libkern/libkern.h to sys/cdefs.h. Add a __-prefix to SHIFTIN
and SHIFTOUT, and add a manual page for the bit-twiddling macros,
bits(3).

Make the __BIT and __BITS macros "widthless," as best I can, by
changing their type to uintmax_t from uint32_t. XXX The manual
page lags this change by a bit.

Define __PRIxBIT and __PRIxBITS printf(3) format strings.

branches: 1.60.4; 1.60.8;
merge ktrace-lwp.

branches: 1.59.2;
Add an __UNVOLATILE() macro. It should be used with caution, but
it is required to use this whenever you want to pass a pointer to
volatile data e.g. to memset(). This allows us to still compile
files doing such things with -Wcast-qual and get the rest of the
code checked under that option.

Based on suggestions from tron and christos.

branches: 1.58.8;
kill gcc specific version of __UNCONST. Does not work to unconst
const char *foo[];

__UNCONST: add parens around a macro argument.

a little safer impl of __UNCONST, using __typeof__ if __GNUC__.

DECONST->UNCONST

add __DECONST()

The __used__ attribute first appeared in gcc 3.1, not in 2.7, according
to the gcc expertise. Fixes build problem for the vax port, which still
uses gcc 2.95.3.

define a __used attribute (empty for gcc<2.7)

branches: 1.51.4;
Add a __insn_barrier() macro to stop the optimizer from moving code
accross the barrier or assume liveness of register values.
Suggested by Jason Thorpe and Steve Woodford.

trim leading whitespace from an #error, shuts up warning from
makedepend.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.48.2;
"Utilize" has exactly the same meaning as "use," but it is more
difficult to read and understand. Most manuals of English style
therefore say that you should use "use".

get rid of the != 0 in the non-gcc aware case.

It is not valid C++ to have a semicolon after
extern "C" {}
so remove it from __END_DECLS.

Add support for "link sets", which are arrays of pointers to objects
gathered together in named sections by the linker.

Deal with the fact that __GNUC__ is not defined when preprocessing
assembler (Grr).

Add __unused, __packed, __aligned(), and __section() macros. Inspired
by FreeBSD.

branches: 1.42.10;
Provide compat definition of __func__ for pre-C99 compiler.

branches: 1.41.2;
Add a __static_cast() macro to help standard headers when used in C++
compile environments using G++'s -Wold-style-cast warning;
suggested by Dave Sainty in PR lib/11766.

branches: 1.40.2;
Make __restrict actually DTRT for non-C99 GCC >= 2.92.

Provide a stub for restrict.

Remove the "kprintf" gcc attribute permanently. Use standard "printf"
format checking. We are now at 1.5E, as the removal of %b will cause
third-party LKMs to break.

#ifdef __STDC__ -> #if __STDC__

Spelling nit.

Don't define __inline as "/* delete GCC keyword */" if __lint__ is
defined - lint(1) already knows about the __inline modifier.

This stops lint from generating "static function ... unused" warnings
for static __inline functions.

Add an additional usage note about using __predict_*() only in hot spots,
as suggested by Chris Demetriou.

Add __predict_true() and __predict_false() macros to access the
explicit branch prediction available on GCC 2.96 and later. See
the comment regarding usage.

Add a new macro, __GNUC_PREREQ__(major, minor) which tests to see if
the compiler is GCC and at least the version specified by <major,minor>,
and use it in a few appropriate places in this file.

instead of just going on as normal if __RENAME() is used in kernel
(_KERNEL) or standalone (_STANDALONE) files, replace it with some
text that'll cause an error. __RENAME() should never be used in
the kernel (there's no need, at least, with the current way of doing
things), and is downright annoying in standalone code. (In a standalone
build environment, there may be no sane way to do symbol renaming,
which means that even just faking it and defining it to emptyness
would cause problems if it were actually needed.)

Fix symbol renaming on cc -traditional.
Fix PRs bin/5167 and lib/6310.

branches: 1.29.8; 1.29.14;
Factor out a.out vs. ELF cdefs from the various <machine/cdefs.h> files,
and place them in cdefs_{aout,elf}.h as appropriate. Rearrange cdefs.h
to account for this.

Delete __extension__ on non-GCC or GCC1.

Make many of the new consts dependent on a new `__AUDIT__' flag, to avoid
breaking third party software. *sigh*

___CONCAT was Broken. (The new version may not work exactly as people
would expect, but at least cpp doesn't choke on it.)

Merge with Lite2 + local changes

Define ___CONCAT() and ___STRING() before including <machine/cdefs.h>
so that the appropriate CPP evil takes place.

- define ___STRING() and ___CONCAT() macros which invoke
their double-underscore counterparts (cpp evil).
- define __RENAME() to do what lint expects, so that
renamed functions are handled properly.

From Chris Demetriou <cgd@pa.dec.com>.

lint -> __lint

Define __RENAME as a noop if lint is defined.
[probably needs pull-up]

Implement __RENAME() in <machine/cdefs.h>

New hacks to make libc work painlessly without bumping the major number:
use type func(arg1s) asm("emitted_name") gcc mechanism.
Suggested by Bill Sommerfeld.

branches: 1.18.8;
Add __IDSTRING, __RCSID, and __COPYRIGHT macros.

add multiple inclusion protection

Change kprintf attribute to be conditional on the pre-processor define
__KPRINTF_ATTRIBUTE__ so that our kernel compiles cleanly with versions
of gcc that do not support the kprintf format attribute.

Machine dependant stuff has been moved to <machine/cdefs.h>.

Fix typos.

Added __weak_reference() macro.

one too many #endif's.

Added __warn_references macro, which is used to instruct the linker to
print a warning message if a given symbol is referenced.

branches: 1.10.2;
New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

new standard, minimally intrusive ID format

update from Lite, with a few fixes that have been punted back.

handle __attribute__ correctly when using gcc -traditional.
suggested, but different than what provided by Mark Weaver.

Disable GCC's __attribute__ extension when we're not using GCC.

if __P is already defined, undef it.

branches: 1.4.4;
add "dead" and "pure" declarations, as provided by new db code

add rcs ids as necessary, and also clean up headers

Add consistent multiple-inclusion protection.

branches: 1.1.1;
Initial revision

sys/cdefs.h: Make various macros work more robustly.

Use predefined __-namespace macros inside __BIT, __type_min,
__type_max, and __type_fit:

- Use __CHAR_BIT__ instead of NBBY so this works without sys/types.h
and without _NETBSD_SOURCE.

- Use __INTMAX_TYPE__, __UINTMAX_TYPE__ instead of intmax_t, uintmax_t
so this works without stdint.h.

No functional change intended.

sys/cdefs.h: pass __aligned to lint

Lint could parse _Alignas and __attribute__((__aligned__(4))) previously
but simply ignored them. Since today, they affect the layout of struct
and union.

sys/cdefs.h: New __MACROUSE for macros to type-check arguments.

This way, if there's a macro F(x) with a conditional definition --
e.g., conditional on DIAGNOSTIC or KDTRACE_HOOKS -- it can do
__MACROUSE(x) in the definition that's supposed to compile away,
without triggering `variable set but not used' errors, while still
catching type errors in the expression x. But there's no cost or
side effects incurred in the generated code because the value is not
computed.

This should be the same as __USE, but I haven't figured out how to
make it work for both bit fields (which are likely to appear in macro
arguments) and aggregates (structs/unions, which are likely to appear
as variable declarations), so for now we use two separate macros.

Add __MASK(3)

__MASK(n): first n bits all set, where __MASK(4) == 0b1111.

don't gut restrict for lint.

Provide __CONCATn macros that take from 3 to 8 arguments and concatenate
them.

I didn't provide the non-STDC versions

remove unused "_DIAGNOSTIC" option and opt_diagnostic.h.
note that this is unrelated to the widely used "DIAGNOSTIC" option.

add __null_sentinel (from FreeBSD)

branches: 1.154.2;
For NO_KERNEL_RCSIDS, strip __RCSID() also for src/common/*.

Don't use typedef at all for __CTASSERT1.

Fix __CTASSERT1() in sys/cdefs.h for recent Clang/LLVM

Clang now implements a restriction on giving non-C-compatible anonymous
structs a typedef name for linkage purposes, as described in C++ committee
paper `P1766R1 <http://wg21.link/p1766r1>'.

https://reviews.llvm.org/D74103

branches: 1.151.2;
Expand the support of __no[sanitizer] attributes

Add support for RUMPKERNEL that can reuse these attributes in the same code.
These macros are not intended to be used by userland and are still disabled
there. They are a NetBSD specific extension.

Add proper support for clang and GCC.

Set __no[sanitizer] only under a sanitizer, as otherwise there are build
warnings about unused compiler attributes.

Reviewed by <maxv>

Fix __nomsan: missing opt_kmsan.h, and the attribute should be
kernel-memory.

Add support for Kernel Memory Sanitizer (kMSan). It detects uninitialized
memory used by the kernel at run time, and just like kASan and kCSan, it
is an excellent feature. It has already detected 38 uninitialized variables
in the kernel during my testing, which I have since discreetly fixed.

We use two shadows:
- "shad", to track uninitialized memory with a bit granularity (1:1).
Each bit set to 1 in the shad corresponds to one uninitialized bit of
real kernel memory.
- "orig", to track the origin of the memory with a 4-byte granularity
(1:1). Each uint32_t cell in the orig indicates the origin of the
associated uint32_t of real kernel memory.

The memory consumption of these shadows is consequent, so at least 4GB of
RAM is recommended to run kMSan.

The compiler inserts calls to specific __msan_* functions on each memory
access, to manage both the shad and the orig and detect uninitialized
memory accesses that change the execution flow (like an "if" on an
uninitialized variable).

We mark as uninit several types of memory buffers (stack, pools, kmem,
malloc, uvm_km), and check each buffer passed to copyout, copyoutstr,
bwrite, if_transmit_lock and DMA operations, to detect uninitialized memory
that leaves the system. This allows us to detect kernel info leaks in a way
that is more efficient and also more user-friendly than KLEAK.

Contrary to kASan, kMSan requires comprehensive coverage, ie we cannot
tolerate having one non-instrumented function, because this could cause
false positives. kMSan cannot instrument ASM functions, so I converted
most of them to __asm__ inlines, which kMSan is able to instrument. Those
that remain receive special treatment.

Contrary to kASan again, kMSan uses a TLS, so we must context-switch this
TLS during interrupts. We use different contexts depending on the interrupt
level.

The orig tracks precisely the origin of a buffer. We use a special encoding
for the orig values, and pack together in each uint32_t cell of the orig:
- a code designating the type of memory (Stack, Pool, etc), and
- a compressed pointer, which points either (1) to a string containing
the name of the variable associated with the cell, or (2) to an area
in the kernel .text section which we resolve to a symbol name + offset.

This encoding allows us not to consume extra memory for associating
information with each cell, and produces a precise output, that can tell
for example the name of an uninitialized variable on the stack, the
function in which it was pushed on the stack, and the function where we
accessed this uninitialized variable.

kMSan is available with LLVM, but not with GCC.

The code is organized in a way that is similar to kASan and kCSan, so it
means that other architectures than amd64 can be supported.

Add Kernel Concurrency Sanitizer (kCSan) support. This sanitizer allows us
to detect race conditions at runtime. It is a variation of TSan that is
easy to implement and more suited to kernel internals, albeit theoretically
less precise than TSan's happens-before.

We do basically two things:

- On every KCSAN_NACCESSES (=2000) memory accesses, we create a cell
describing the access, and delay the calling CPU (10ms).

- On all memory accesses, we verify if the memory we're reading/writing
is referenced in a cell already.

The combination of the two means that, if for example cpu0 does a read that
is selected and cpu1 does a write at the same address, kCSan will fire,
because cpu1's write collides with cpu0's read cell.

The coverage of the instrumentation is the same as that of kASan. Also, the
code is organized in a way similar to kASan, so it is easy to add support
for more architectures than amd64. kCSan is compatible with KCOV.

Reviewed by Kamil.

Add and use __FPTRCAST, requested by uwe@

Handle LSan/LLVM and LSan/GCC in __NO_LEAKS

__has_feature(leak_sanitizer) was merged with Clang/LLVM today:
https://reviews.llvm.org/D67719

GCC specific ifdef __SANITIZE_LEAK__ is pending in upstream review...
https://gcc.gnu.org/ml/gcc-patches/2019-09/msg01270.html and can be
rejected as GCC upstream does not see value in feature parity with LLVM
sanitizers. For the time being this will be a NetBSD specific extension.

Make __CTASSERT static assert again

Today GCC/Clang allow to specify typedef char[] with the dynamic VLA
property (as introduced in C99). This means that __CTASSERT(), when
misused with run-time semantics, was a dummy check generating either
1 or -1 size of typedef char[].

It was caught in runtime by kUBSan as -1 is size of VLA with unspecified
semantics in runtime (Undefined Behavior).

Use bit-field to enforce compile-time constant.

This approach has been inspired by the Perl variation of static_assert().

Define __noubsan in sys/cdefs.h for KERNEL sanitization

Define __NO_LEAKS in sys/cdefs.h

This preprocessor symbol is intended to be used with leak detecting
software, documenting leaks that are not important to be freed in the
default build version.

Add Clang/LLVM specific feature/extension detection macros in sys/cdefs.h

These macros are not supported (as of now) with GCC and there is need to
maintain a fallback that evaluates to 0.

add a lint(1) comment to nothing.

lint understands attributes.

Appease gcc error: comparison of unsigned expression < 0 is always false
when using __BITS(u_int, 0)

Stop mangling __func__ for C++11 and newer

Drop local logic between GCC 2.4 and GCC 2.6 that used __PRETTY_FUNCTION__.
This caused __func__ to be redefined for all C++ programs and use a
different behavior than intended by the compiler (Clang and GCC).
__PRETTY_FUNCTION__ prints all the prototype not just function name,
contrary to __FUNCTION__ and __func__.

__func__ is now an integral part of C99 and C++11, shipped by a compiler.

This change aligns the behavior of C++ programs using __func__ to other
Operating Systems. The difference caused unnecessary fallout in regression
test suites in projects (LLVM, fish, ...).

Add support for monitoring the stack with kASan. This allows us to detect
illegal memory accesses occuring there.

The compiler inlines a piece of code in each function that adds redzones
around the local variables and poisons them. The illegal accesses are then
detected using the usual kASan machinery.

The stack size is doubled, from 4 pages to 8 pages.

Several boot functions are marked with the __noasan flag, to prevent the
compiler from adding redzones in them (because we haven't yet initialized
kASan). The kasan_early_init function is called early at boot time to
quickly create the shadow for the current stack; after this is done, we
don't need __noasan anymore in the boot path.

We pass -fasan-shadow-offset=0xDFFF900000000000, because the compiler
wants to do
shad = shadow-offset + (addr >> 3)
and we do, in kasan_addr_to_shad
shad = KASAN_SHADOW_START + ((addr - CANONICAL_BASE) >> 3)
hence
shad = KASAN_SHADOW_START + (addr >> 3) - (CANONICAL_BASE >> 3)
= [KASAN_SHADOW_START - (CANONICAL_BASE >> 3)] + (addr >> 3)
implies
shadow-offset = KASAN_SHADOW_START - (CANONICAL_BASE >> 3)
= 0xFFFF800000000000 - (0xFFFF800000000000 >> 3)
= 0xDFFF900000000000

In UVM, we add a kasan_free (that is not preceded by a kasan_alloc). We
don't add poisoned redzones ourselves, but all the functions we execute
do, so we need to manually clear the poison before freeing the stack.

With the help of Kamil for the makefile stuff.

Remove dependency of __BITS on MAX/MIN by providing __MAX/__MIN

branches: 1.135.2; 1.135.4;
add linted to __USE()

lint knows about all inline variant syntax...

branches: 1.133.2;
Ignore __thread for lint for now

branches: 1.132.6;
use __nothing instead since __empty is taken in stl_deque.h

remove comment in comment

add __empty

branches: 1.129.2;
Our lint knows about attributes, stop eating them.

branches: 1.128.2;
long line police

introduce a __syslog__ format, and __sysloglike() macros. If __syslog__
is not available, this fails back to __printf__

wishful thinking?

Include opt_diagnostic.h.

add constcond

add cast-through-void * macros

branches: 1.122.2;
Don't use or in __RENAME because it triggers -Wc++-compat

Add __unreachable(), which can be used to mark dead branches when the
compiler can't tell side effects.

remove PCC specific definitions for __packed, __aligned and __section
which result in a _Pragma() usage. I don't think this ever worked,
as you can't concatenate string literals in this way. A warning
would have been produced, but until recently did not result in an
error condition so this was overlooked. Use __attribute__ instead as
this is supported by PCC.

branches: 1.119.2;
For compilers without __COUNTER__, make the ctassert name contain
__INCLUDE_LEVEL__ ## _ ## __LINE__. It's not perfect, but at least it's
better than just __LINE__ since it avoids collisions between .c's and .h's.

Incidentally, why does half of the kernel call CTASSERT() and the
other half __CTASSERT()?

Add another set of parens

mask the shift by __n with NBBY*sizeof(uintmax-t)-1
to suppress the following diagnostic from clang:
error: shift count >= width of type [-Werror,-Wshift-count-overflow]
PAR_ATTR = __BITS(63,56),// F=0 memory attributes
^~~~~~~~~~~~~
src/sys/sys/cdefs.h:554:4: note: expanded from macro '__BITS'
((__BIT(MAX((__m), (__n)) + 1) - 1) ^ (__BIT(MIN((__m), (__n))) - 1))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/sys/sys/cdefs.h:550:73: note: expanded from macro '__BIT'
(((uintmax_t)(__n) >= NBBY * sizeof(uintmax_t)) ? 0 : ((uintmax_t)1 << (uintmax_t)(__n)))
^ ~~~~~~~~~~~~~~~~

Now that these attributes are documented in attribute(3), shorten
the comments for __used, __unused, __diagused, and __debugused.
Also s/variable/item/ because the attributes may bve applied
to functions.

Add __diagused and __debugused. These are for marking variables that
are used only in diagnotic or debug code, but unused when NDEBUG is
defined, or DIAGNOSTIC is not defined, or DEBUG is not defined.

Add comments explaining what __unused and __used are for.

introduce __USE(variable) that uses a variable to squash unused variable
warnings.

Remove __CT_LOCAL_PROLOGUE/EPILOGUE hack - instead just mark the typedef
as __unused. Duh!

Define a prologue/epilogue for CTASSERTs using local variables (to avoid
warnings about decalarations of localy defined but unused types)

Unbreak vax build (which still uses gcc 4.1). See PR lib/48131.

Implement __negative_p without floating-point arithmetic, using
a solution proposed by jxh on Stack Overflow. Fixes the second
half of PR lib/48131.

While there, simplify __type_fit_u by using the same logic
as in __type_fit_s.

ok christos@

Check for overflow in __type_fit_s when casting to intmax_t.
Fixes the first half of PR lib/48131.

ok christos@

branches: 1.107.2;
While visibility "protected" is nominaly supported by gcc 4.0 and 4.1
it does not actually work - the compiler does not emmit ".protected"
asm statements for used references to protected symbols, which then
causes the linker to fail and/or produce unloadable libraries.
This recently happened to port vax by the locale changes.

Backporting a fix (ASM_OUTPUT_EXTERNAL in gcc target config) is not
feasible.

So: define __dso_protected only starting with gcc 4.2.

Add protected visibility marker for things that we want to keep public
for historical ABI issues, but that are not allowed to be overriden.

Fix comment documenting __link_set_decl() macro.

The `__link_set_decl()` macro's replacement text includes a `*` after
`ptype`, so `ptype` is the pointed-at type (the type of a dereferenced
array entry), not the pointer type.

(This is a comment-only change.)

(From Richard Hansen of BBN.)

Don't define __BIT/__BITS if __ASSEMBLER__ is defined.
(since they use C syntax they won't work anyways).

For GCC 4.1 and later, use the __alignof__ keyword.

define __alignof() in terms of __alignof__ if it is available.

Add an __alignof() macro.

branches: 1.100.2;
use #elif rather than nesting #elses

Add a __always_inline

Fix a (obvious) typo

remove extra ;

add constcond

use __inline to fix nspr's configure issue

- this file is still used from assembly. protect inlines against __ASSEMBLER__
- rename __zero -> __zeroll, __negative -> __negative_p

Type macros providing min and max values for the given type, plus one that
returns if a value can be represented in a given type.

Backout previous - we do not need it anymore

There are some places where C99 allows a restrict modifier (and posix
demands it), but C++ does not allow it. So add a C only version of
__restrict, which expands to nothing if compiling C++.
See http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49347 for a discussion.

PR 46040:
If the current compiler doesn't support C99, check if it is compatible
with GCC 2.92. In that case, use the protected __restricted__ form.
In any other case, default to removing __restricted.

branches: 1.89.4; 1.89.6;
Add __returns_twice for the attribute of the same name. This makes the
attribute explicit based on the functions GCC gives it too.

branches: 1.88.2;
add __noclone for gcc 4.5.

Add __strict_weak_alias(), the type-safe alternative to __weak_alias().

Added __packed define to be able to use eMbedded Visual C++ for building hpcboot.exe.

Add an optional MD calling convention flag for use in libsa when space
optimisation is critical. Use this on i386 to switch to register passing
calling convention for the file system entry points and most assembler
call backs that have to preserve at least 3 registers.

branches: 1.84.2;
Make __CTASSERT use __COUNTER__ instead of __LINE__ if the cpp supports it.

Add __CTASSERT(x)

Add a __noprofile keyword to disable the profiling of a function.

branches: 1.81.2; 1.81.4;
Rename __BEGIN_PUBLIC / __BEGIN_HIDDEN to __BEGIN_PUBLIC_DECLS /
__BEGIN_HIDDEN_DECLS and corresponding __END_* macros. Push the extern
"C" logic into __BEGIN_PUBLIC_DECLS / __BEGIN_HIDDEN_DECLS to make them
easier to use in header files used by C++.

Add __BEGIN_PUBLIC / __END_PUBLIC, __BEGIN_HIDDEN / __END_HIDDEN and
__dso_public and __dso_hidden markers. Change __BEGIN_DECLS /
__END_DECLS to include __BEGIN_PUBLIC / __END_PUBLIC.

Define a new __c99inline macro for compilers known to implement the C99
behavior. This unbreaks GCC 4.4's libgfortran build with the old
signal.h logic, because GCC decided to put the body for the sigsetop
functions in multiple objects.

branches: 1.78.2; 1.78.4;
lint knows __packed now.

Create and use __CAST(type, value) in headers so that modern c++ with
-Wold-style-casts does not bitch.

Add __constfunc and explain how it differs from __pure.

Fix _packed attribute for PCC. According to Ragge it should be _Pragma("packed
1") instead of _Pragma("packed").

With this fix userland programs needing _packed will now work.

Cast the argument of the __BIT to an unsigned type, since it does not make
sense for it to be signed and gcc complains if it is.

Pass argument to __aligned() through __STRING() so that it is correctly expanded. Now __aligned(CACHE_LINE_SIZE) works with pcc.

branches: 1.72.2;
As promised in the commit message, revert previous. __RENAME() is
not required by rumpkernel.

Allow __RENAME if _RUMPKERNEL
(although I'll probably revert this soon, but add it now to allow build)

Add the __printflike(), __scanflike() and __format_arg() macros, from FreeBSD

They will be used soon by the Atheros HAL code, many other places can use them
to avoid GCC dependency.

branches: 1.69.2; 1.69.10; 1.69.14;
Add __packed and __aligned support for PCC.
Define away restrict for __lint__.

branches: 1.68.2;
pcc now supports __section().

branches: 1.67.2;
Add a __noinline attribute. Suggested by christos@.

branches: 1.66.14; 1.66.16; 1.66.18; 1.66.20;
Separate handling of __attribute__, __dead and __pure:
- define away __attribute__ if not running GCC or running GCC < 2.0.
- use __attribute__((__return__)) for GCC >= 2.5, keep other cases.
- use __attribute__((__pure__)) for GCC >= 29.6, keep other cases.

branches: 1.65.6;
Add basic defines to be able to use pcc as compiler (renaming etc).

branches: 1.64.8; 1.64.22; 1.64.24;
Cosmetic: join lines.

Stop using typeof() in the bit-twiddling macros, per yamt@'s
suggestion. This change requires that I use the __PRIuBITS format
string in atw and rtw, so do that.

Define __used as __unused for gcc's that don't grok __attribute__((__used__))

Those older versions of gcc don't eliminate unused functions/vars
anyway, so it's enough just to suppress the warning.

branches: 1.61.2; 1.61.4;
Per discussion on tech-kern and tech-userlevel, move the bit-twiddling
macros, __BIT, __BITS, SHIFTIN, SHIFTOUT, and __arraycount() from
lib/libkern/libkern.h to sys/cdefs.h. Add a __-prefix to SHIFTIN
and SHIFTOUT, and add a manual page for the bit-twiddling macros,
bits(3).

Make the __BIT and __BITS macros "widthless," as best I can, by
changing their type to uintmax_t from uint32_t. XXX The manual
page lags this change by a bit.

Define __PRIxBIT and __PRIxBITS printf(3) format strings.

branches: 1.60.4; 1.60.8;
merge ktrace-lwp.

branches: 1.59.2;
Add an __UNVOLATILE() macro. It should be used with caution, but
it is required to use this whenever you want to pass a pointer to
volatile data e.g. to memset(). This allows us to still compile
files doing such things with -Wcast-qual and get the rest of the
code checked under that option.

Based on suggestions from tron and christos.

branches: 1.58.8;
kill gcc specific version of __UNCONST. Does not work to unconst
const char *foo[];

__UNCONST: add parens around a macro argument.

a little safer impl of __UNCONST, using __typeof__ if __GNUC__.

DECONST->UNCONST

add __DECONST()

The __used__ attribute first appeared in gcc 3.1, not in 2.7, according
to the gcc expertise. Fixes build problem for the vax port, which still
uses gcc 2.95.3.

define a __used attribute (empty for gcc<2.7)

branches: 1.51.4;
Add a __insn_barrier() macro to stop the optimizer from moving code
accross the barrier or assume liveness of register values.
Suggested by Jason Thorpe and Steve Woodford.

trim leading whitespace from an #error, shuts up warning from
makedepend.

Move UCB-licensed code from 4-clause to 3-clause licence.

Patches provided by Joel Baker in PR 22364, verified by myself.

branches: 1.48.2;
"Utilize" has exactly the same meaning as "use," but it is more
difficult to read and understand. Most manuals of English style
therefore say that you should use "use".

get rid of the != 0 in the non-gcc aware case.

It is not valid C++ to have a semicolon after
extern "C" {}
so remove it from __END_DECLS.

Add support for "link sets", which are arrays of pointers to objects
gathered together in named sections by the linker.

Deal with the fact that __GNUC__ is not defined when preprocessing
assembler (Grr).

Add __unused, __packed, __aligned(), and __section() macros. Inspired
by FreeBSD.

branches: 1.42.10;
Provide compat definition of __func__ for pre-C99 compiler.

branches: 1.41.2;
Add a __static_cast() macro to help standard headers when used in C++
compile environments using G++'s -Wold-style-cast warning;
suggested by Dave Sainty in PR lib/11766.

branches: 1.40.2;
Make __restrict actually DTRT for non-C99 GCC >= 2.92.

Provide a stub for restrict.

Remove the "kprintf" gcc attribute permanently. Use standard "printf"
format checking. We are now at 1.5E, as the removal of %b will cause
third-party LKMs to break.

#ifdef __STDC__ -> #if __STDC__

Spelling nit.

Don't define __inline as "/* delete GCC keyword */" if __lint__ is
defined - lint(1) already knows about the __inline modifier.

This stops lint from generating "static function ... unused" warnings
for static __inline functions.

Add an additional usage note about using __predict_*() only in hot spots,
as suggested by Chris Demetriou.

Add __predict_true() and __predict_false() macros to access the
explicit branch prediction available on GCC 2.96 and later. See
the comment regarding usage.

Add a new macro, __GNUC_PREREQ__(major, minor) which tests to see if
the compiler is GCC and at least the version specified by <major,minor>,
and use it in a few appropriate places in this file.

instead of just going on as normal if __RENAME() is used in kernel
(_KERNEL) or standalone (_STANDALONE) files, replace it with some
text that'll cause an error. __RENAME() should never be used in
the kernel (there's no need, at least, with the current way of doing
things), and is downright annoying in standalone code. (In a standalone
build environment, there may be no sane way to do symbol renaming,
which means that even just faking it and defining it to emptyness
would cause problems if it were actually needed.)

Fix symbol renaming on cc -traditional.
Fix PRs bin/5167 and lib/6310.

branches: 1.29.8; 1.29.14;
Factor out a.out vs. ELF cdefs from the various <machine/cdefs.h> files,
and place them in cdefs_{aout,elf}.h as appropriate. Rearrange cdefs.h
to account for this.

Delete __extension__ on non-GCC or GCC1.

Make many of the new consts dependent on a new `__AUDIT__' flag, to avoid
breaking third party software. *sigh*

___CONCAT was Broken. (The new version may not work exactly as people
would expect, but at least cpp doesn't choke on it.)

Merge with Lite2 + local changes

Define ___CONCAT() and ___STRING() before including <machine/cdefs.h>
so that the appropriate CPP evil takes place.

- define ___STRING() and ___CONCAT() macros which invoke
their double-underscore counterparts (cpp evil).
- define __RENAME() to do what lint expects, so that
renamed functions are handled properly.

From Chris Demetriou <cgd@pa.dec.com>.

lint -> __lint

Define __RENAME as a noop if lint is defined.
[probably needs pull-up]

Implement __RENAME() in <machine/cdefs.h>

New hacks to make libc work painlessly without bumping the major number:
use type func(arg1s) asm("emitted_name") gcc mechanism.
Suggested by Bill Sommerfeld.

branches: 1.18.8;
Add __IDSTRING, __RCSID, and __COPYRIGHT macros.

add multiple inclusion protection

Change kprintf attribute to be conditional on the pre-processor define
__KPRINTF_ATTRIBUTE__ so that our kernel compiles cleanly with versions
of gcc that do not support the kprintf format attribute.

Machine dependant stuff has been moved to <machine/cdefs.h>.

Fix typos.

Added __weak_reference() macro.

one too many #endif's.

Added __warn_references macro, which is used to instruct the linker to
print a warning message if a given symbol is referenced.

branches: 1.10.2;
New RCS ID's, take two. they're more aesthecially pleasant, and use 'NetBSD'

new standard, minimally intrusive ID format

update from Lite, with a few fixes that have been punted back.

handle __attribute__ correctly when using gcc -traditional.
suggested, but different than what provided by Mark Weaver.

Disable GCC's __attribute__ extension when we're not using GCC.

if __P is already defined, undef it.

branches: 1.4.4;
add "dead" and "pure" declarations, as provided by new db code

add rcs ids as necessary, and also clean up headers

Add consistent multiple-inclusion protection.

branches: 1.1.1;
Initial revision

sys/cdefs.h: pass __aligned to lint

Lint could parse _Alignas and __attribute__((__aligned__(4))) previously
but simply ignored them. Since today, they affect the layout of struct
and union.

sys/cdefs.h: New __MACROUSE for macros to type-check arguments.

This way, if there's a macro F(x) with a conditional definition --
e.g., conditional on DIAGNOSTIC or KDTRACE_HOOKS -- it can do
__MACROUSE(x) in the definition that's supposed to compile away,
without triggering `variable set but not used' errors, while still
catching type errors in the expression x. But there's no cost or
side effects incurred in the generated code because the value is not
computed.

This should be the same as __USE, but I haven't figured out how to
make it work for both bit fields (which are likely to appear in macro
arguments) and aggregates (structs/unions, which are likely to appear
as variable declarations), so for now we use two separate macros.

Add __MASK(3)

__MASK(n): first n bits all set, where __MASK(4) == 0b1111.

don't gut restrict for lint.

Provide __CONCATn macros that take from 3 to 8 arguments and concatenate
them.

I didn't provide the non-STDC versions

remove unused "_DIAGNOSTIC" option and opt_diagnostic.h.
note that this is unrelated to the widely used "DIAGNOSTIC" option.

add __null_sentinel (from FreeBSD)

branches: 1.154.2;
For NO_KERNEL_RCSIDS, strip __RCSID() also for src/common/*.

Don't use typedef at all for __CTASSERT1.

Fix __CTASSERT1() in sys/cdefs.h for recent Clang/LLVM

Clang now implements a restriction on giving non-C-compatible anonymous
structs a typedef name for linkage purposes, as described in C++ committee
paper `P1766R1 <http://wg21.link/p1766r1>'.

https://reviews.llvm.org/D74103

branches: 1.151.2;
Expand the support of __no[sanitizer] attributes

Add support for RUMPKERNEL that can reuse these attributes in the same code.
These macros are not intended to be used by userland and are still disabled
there. They are a NetBSD specific extension.

Add proper support for clang and GCC.

Set __no[sanitizer] only under a sanitizer, as otherwise there are build
warnings about unused compiler attributes.

Reviewed by <maxv>

Fix __nomsan: missing opt_kmsan.h, and the attribute should be
kernel-memory.

Add support for Kernel Memory Sanitizer (kMSan). It detects uninitialized
memory used by the kernel at run time, and just like kASan and kCSan, it
is an excellent feature. It has already detected 38 uninitialized variables
in the kernel during my testing, which I have since discreetly fixed.

We use two shadows:
- "shad", to track uninitialized memory with a bit granularity (1:1).
Each bit set to 1 in the shad corresponds to one uninitialized bit of
real kernel memory.
- "orig", to track the origin of the memory with a 4-byte granularity
(1:1). Each uint32_t cell in the orig indicates the origin of the
associated uint32_t of real kernel memory.

The memory consumption of these shadows is consequent, so at least 4GB of
RAM is recommended to run kMSan.

The compiler inserts calls to specific __msan_* functions on each memory
access, to manage both the shad and the orig and detect uninitialized
memory accesses that change the execution flow (like an "if" on an
uninitialized variable).

We mark as uninit several types of memory buffers (stack, pools, kmem,
malloc, uvm_km), and check each buffer passed to copyout, copyoutstr,
bwrite, if_transmit_lock and DMA operations, to detect uninitialized memory
that leaves the system. This allows us to detect kernel info leaks in a way
that is more efficient and also more user-friendly than KLEAK.

Contrary to kASan, kMSan requires comprehensive coverage, ie we cannot
tolerate having one non-instrumented function, because this could cause
false positives. kMSan cannot instrument ASM functions, so I converted
most of them to __asm__ inlines, which kMSan is able to instrument. Those
that remain receive special treatment.

Contrary to kASan again, kMSan uses a TLS, so we must context-switch this
TLS during interrupts. We use different contexts depending on the interrupt
level.

The orig tracks precisely the origin of a buffer. We use a special encoding
for the orig values, and pack together in each uint32_t cell of the orig:
- a code designating the type of memory (Stack, Pool, etc), and
- a compressed pointer, which points either (1) to a string containing
the name of the variable associated with the cell, or (2) to an area
in the kernel .text section which we resolve to a symbol name + offset.

This encoding allows us not to consume extra memory for associating
information with each cell, and produces a precise output, that can tell
for example the name of an uninitialized variable on the stack, the
function in which it was pushed on the stack, and the function where we
accessed this uninitialized variable.

kMSan is available with LLVM, but not with GCC.

The code is organized in a way that is similar to kASan and kCSan, so it
means that other architectures than amd64 can be supported.

Add Kernel Concurrency Sanitizer (kCSan) support. This sanitizer allows us
to detect race conditions at runtime. It is a variation of TSan that is
easy to implement and more suited to kernel internals, albeit theoretically
less precise than TSan's happens-before.

We do basically two things:

- On every KCSAN_NACCESSES (=2000) memory accesses, we create a cell
describing the access, and delay the calling CPU (10ms).

- On all memory accesses, we verify if the memory we're reading/writing
is referenced in a cell already.

The combination of the two means that, if for example cpu0 does a read that
is selected and cpu1 does a write at the same address, kCSan will fire,
because cpu1's write collides with cpu0's read cell.

The coverage of the instrumentation is the same as that of kASan. Also, the
code is organized in a way similar to kASan, so it is easy to add support
for more architectures than amd64. kCSan is compatible with KCOV.

Reviewed by Kamil.

Add and use __FPTRCAST, requested by uwe@

Handle LSan/LLVM and LSan/GCC in __NO_LEAKS

__has_feature(leak_sanitizer) was merged with Clang/LLVM today:
https://reviews.llvm.org/D67719

GCC specific ifdef __SANITIZE_LEAK__ is pending in upstream review...
https://gcc.gnu.org/ml/gcc-patches/2019-09/msg01270.html and can be
rejected as GCC upstream does not see value in feature parity with LLVM
sanitizers. For the time being this will be a NetBSD specific extension.

Make __CTASSERT static assert again

Today GCC/Clang allow to specify typedef char[] with the dynamic VLA
property (as introduced in C99). This means that __CTASSERT(), when
misused with run-time semantics, was a dummy check generating either
1 or -1 size of typedef char[].

It was caught in runtime by kUBSan as -1 is size of VLA with unspecified
semantics in runtime (Undefined Behavior).

Use bit-field to enforce compile-time constant.

This approach has been inspired by the Perl variation of static_assert().

Define __noubsan in sys/cdefs.h for KERNEL sanitization

Define __NO_LEAKS in sys/cdefs.h

This preprocessor symbol is intended to be used with leak detecting
software, documenting leaks that are not important to be freed in the
default build version.

Add Clang/LLVM specific feature/extension detection macros in sys/cdefs.h

These macros are not supported (as of now) with GCC and there is need to
maintain a fallback that evaluates to 0.

add a lint(1) comment to nothing.

lint understands attributes.

Appease gcc error: comparison of unsigned expression < 0 is always false
when using __BITS(u_int, 0)

Stop mangling __func__ for C++11 and newer

Drop local logic between GCC 2.4 and GCC 2.6 that used __PRETTY_FUNCTION__.
This caused __func__ to be redefined for all C++ programs and use a
different behavior than intended by the compiler (Clang and GCC).
__PRETTY_FUNCTION__ prints all the prototype not just function name,
contrary to __FUNCTION__ and __func__.

__func__ is now an integral part of C99 and C++11, shipped by a compiler.

This change aligns the behavior of C++ programs using __func__ to other
Operating Systems. The difference caused unnecessary fallout in regression
test suites in projects (LLVM, fish, ...).

Add support for monitoring the stack with kASan. This allows us to detect
illegal memory accesses occuring there.

The compiler inlines a piece of code in each function that adds redzones
around the local variables and poisons them. The illegal accesses are then
detected using the usual kASan machinery.

The stack size is doubled, from 4 pages to 8 pages.

Several boot functions are marked with the __noasan flag, to prevent the
compiler from adding redzones in them (because we haven't yet initialized
kASan). The kasan_early_init function is called early at boot time to
quickly create the shadow for the current stack; after this is done, we
don't need __noasan anymore in the boot path.

We pass -fasan-shadow-offset=0xDFFF900000000000, because the compiler
wants to do
shad = shadow-offset + (addr >> 3)
and we do, in kasan_addr_to_shad
shad = KASAN_SHADOW_START + ((addr - CANONICAL_BASE) >> 3)
hence
shad = KASAN_SHADOW_START + (addr >> 3) - (CANONICAL_BASE >> 3)
= [KASAN_SHADOW_START - (CANONICAL_BASE >> 3)] + (addr >> 3)
implies
shadow-offset = KASAN_SHADOW_START - (CANONICAL_BASE >> 3)
= 0xFFFF800000000000 - (0xFFFF800000000000 >> 3)
= 0xDFFF900000000000

In UVM, we add a kasan_free (that is not preceded by a kasan_alloc). We
don't add poisoned redzones ourselves, but all the functions we execute
do, so we need to manually clear the poison before freeing the stack.

With the help of Kamil for the makefile stuff.

Remove dependency of __BITS on MAX/MIN by providing __MAX/__MIN

branches: 1.135.2; 1.135.4;
add linted to __USE()

lint knows about all inline variant syntax...

branches: 1.133.2;
Ignore __thread for lint for now

branches: 1.132.6;
use __nothing instead since __empty is taken in stl_deque.h

remove comment in comment

add __empty

branches: 1.129.2;
Our lint knows about attributes, stop eating them.

branches: 1.128.2;
long line police

introduce a __syslog__ format, and __sysloglike() macros. If __syslog__
is not available, this fails back to __printf__

wishful thinking?

Include opt_diagnostic.h.

add constcond

add cast-through-void * macros

branches: 1.122.2;
Don't use or in __RENAME because it triggers -Wc++-compat

Add __unreachable(), which can be used to mark dead branches when the
compiler can't tell side effects.

remove PCC specific definitions for __packed, __aligned and __section
which result in a _Pragma() usage. I don't think this ever worked,
as you can't concatenate string literals in this way. A warning
would have been produced, but until recently did not result in an
error condition so this was overlooked. Use __attribute__ instead as
this is supported by PCC.

branches: 1.119.2;
For compilers without __COUNTER__, make the ctassert name contain
__INCLUDE_LEVEL__ ## _ ## __LINE__. It's not perfect, but at least it's
better than just __LINE__ since it avoids collisions between .c's and .h's.

Incidentally, why does half of the kernel call CTASSERT() and the
other half __CTASSERT()?

Add another set of parens

mask the shift by __n with NBBY*sizeof(uintmax-t)-1
to suppress the following diagnostic from clang:
error: shift count >= width of type [-Werror,-Wshift-count-overflow]
PAR_ATTR = __BITS(63,56),// F=0 memory attributes
^~~~~~~~~~~~~
src/sys/sys/cdefs.h:554:4: note: expanded from macro '__BITS'
((__BIT(MAX((__m), (__n)) + 1) - 1) ^ (__BIT(MIN((__m), (__n))) - 1))
^~~~~~~~~~~~~~~~~~~~~~~~~~~~
src/sys/sys/cdefs.h:550:73: note: expanded from macro '__BIT'
(((uintmax_t)(__n) >= NBBY * sizeof(uintmax_t)) ? 0 : ((uintmax_t)1 << (uintmax_t)(__n)))
^ ~~~~~~~~~~~~~~~~

Now that these attributes are documented in attribute(3), shorten
the comments for __used, __unused, __diagused, and __debugused.
Also s/variable/item/ because the attributes may bve applied
to functions.

Add __diagused and __debugused. These are for marking variables that
are used only in diagnotic or debug code, but unused when NDEBUG is
defined, or DIAGNOSTIC is not defined, or DEBUG is not defined.

Add comments explaining what __unused and __used are for.

introduce __USE(variable) that uses a variable to squash unused variable
warnings.

Remove __CT_LOCAL_PROLOGUE/EPILOGUE hack - instead just mark the typedef
as __unused. Duh!

Define a prologue/epilogue for CTASSERTs using local variables (to avoid
warnings about decalarations of localy defined but unused types)

Unbreak vax build (which still uses gcc 4.1). See PR lib/48131.

Implement __negative_p without floating-point arithmetic, using
a solution proposed by jxh on Stack Overflow. Fixes the second
half of PR lib/48131.

While there, simplify __type_fit_u by using the same logic
as in __type_fit_s.

ok christos@

Check for overflow in __type_fit_s when casting to intmax_t.
Fixes the first half of PR lib/48131.

ok christos@

branches: 1.107.2;
While visibility "protected" is nominaly supported by gcc 4.0 and 4.1
it does not actually work - the compiler does not emmit ".protected"
asm statements for used references to protected symbols, which then
causes the linker to fail and/or produce unloadable libraries.
This recently happened to port vax by the locale changes.

Backporting a fix (ASM_OUTPUT_EXTERNAL in gcc target config) is not
feasible.

So: define __dso_protected only starting with gcc 4.2.

Add protected visibility marker for things that we want to keep public
for historical ABI issues, but that are not allowed to be overriden.

Fix comment documenting __link_set_decl() macro.

The `__link_set_decl()` macro's replacement text includes a `*` after
`ptype`, so `ptype` is the pointed-at type (the type of a dereferenced
array entry), not the pointer type.

(This is a comment-only change.)

(From Richard Hansen of BBN.)

Don't define __BIT/__BITS if __ASSEMBLER__ is defined.
(since they use C syntax they won't work anyways).

For GCC 4.1 and later, use the __alignof__ keyword.

define __alignof() in terms of __alignof__ if it is available.

Add an __alignof() macro.

branches: 1.100.2;
use #elif rather than nesting #elses

Add a __always_inline

Fix a (obvious) typo

remove extra ;

add constcond

use __inline to fix nspr's configure issue

- this file is still used from assembly. protect inlines against __ASSEMBLER__
- rename __zero -> __zeroll, __negative -> __negative_p

Type macros providing min and max values for the given type, plus one that
returns if a value can be represented in a given type.

Backout previous - we do not need it anymore

There are some places where C99 allows a restrict modifier (and posix
demands it), but C++ does not allow it. So add a C only version of
__restrict, which expands to nothing if compiling C++.
See http://gcc.gnu.org/bugzilla/show_bug.cgi?id=49347 for a discussion.

PR 46040:
If the current compiler doesn't support C99, check if it is compatible
with GCC 2.92. In that case, use the protected __restricted__ form.
In any other case, default to removing __restricted.

branches: 1.89.4; 1.89.6;
Add __returns_twice for the attribute of the same name. This makes the
attribute explicit based on the functions GCC gives it too.

branches: 1.88.2;
add __noclone for gcc 4.5.

Add __strict_weak_alias(), the type-safe alternative to __weak_alias().

Added __packed define to be able to use eMbedded Visual C++ for building hpcboot.exe.

Add an optional MD calling convention flag for use in libsa when space
optimisation is critical. Use this on i386 to switch to register passing
calling convention for the file system entry points and most assembler
call backs that have to preserve at least 3 registers.

branches: 1.84.2;
Make __CTASSERT use __COUNTER__ instead of __LINE__ if the cpp supports it.

Add __CTASSERT(x)

Add a __noprofile keyword to disable the profiling of a function.

branches: 1.81.2; 1.81.4;
Rename __BEGIN_PUBLIC / __BEGIN_HIDDEN to __BEGIN_PUBLIC_DECLS /
__BEGIN_HIDDEN_DECLS and corresponding __END_* macros. Push the extern
"C" logic into __BEGIN_PUBLIC_DECLS / __BEGIN_HIDDEN_DECLS to make them
easier to use in header files used by C++.

Add __BEGIN_PUBLIC / __END_PUBLIC, __BEGIN_HIDDEN / __END_HIDDEN and
__dso_public and __dso_hidden markers. Change __BEGIN_DECLS /
__END_DECLS to include __BEGIN_PUBLIC / __END_PUBLIC.

Define a new __c99inline macro for compilers known to implement the C99
behavior. This unbreaks GCC 4.4's libgfortran build with the old
signal.h logic, because GCC decided to put the body for the sigsetop
functions in multiple objects.

branches: 1.78.2; 1.78.4;
lint knows __packed now.