sys/sys: Fix __builtin_is_aligned fallback

When the compiler doesn't provide __builtin_is_aligned we use
macro as a fallback. The macro was missing brackets around one
argument. This could lead to incorrect results when the argument is
more complex than a single stagement.

Fix this by adding the needed brackets.

Reviewed by: brooks, imp, jhb
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D45260

Prepare the system for _FORTIFY_SOURCE

Notably:
- libc needs to #undef some of the macros from ssp/* for underlying
implementations
- ssp/* wants a __RENAME() macro (snatched more or less from NetBSD)

There's some extra hinkiness included for read(), since libc spells it
as "_read" while the rest of the world spells it "read."

Reviewed by: imp, ngie
Sponsored by: Stormshield
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D32307

cdefs: Introduce __result_use_or_ignore_check

Try to paper over inconsistent semantics for __warn_unused_result__
between clang and gcc. See
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66425 for a spirited
discussion of these semantics.

Introduce __result_use_or_ignore_check, which allows callers to
explicitly ignore the return value with a cast to void. Use that to
restore some checking for copyout() and friends, previously removed in
commit d07acc58d898 ("systm: Relax __result_use_check annotations").

Reviewed by: olce, rpokala, kib, emaste
MFC after: 1 month
Differential Revision: https://reviews.freebsd.org/D43426

sys/cdefs.h: add __noexcept and __noexcept_if

These macros provide the C++11 noexcept and noexcept(...) keywords if
we're compiling in a C++11 environment. Otherwise, they expand to an
empty string.

This will be used to add the required noexcept specifier to several libc
functions as required in C++11.

MFC after: 2 weeks

Reviewed by: imp
Pull Request: https://github.com/freebsd/freebsd-src/pull/1085

cdefs: Remove __func__ stub.

Redo 17a238a15fbe. Remove the __func__ crutch for gcc 2.95 and earlier.
We don't need it today to build the tree (since gcc < 12 is unlikely to
work). And it's not used in any system header that's part of the
standard interfaces today (so we don't need it for compatibility). And
we have other issues that make gcc < 4.2 unlikely to work today with
system headers.

Sponsored by: Netflix

Revert "cdefs: Remove __func__ define"

This reverts commit 17a238a15fbed01477fbc54744d35cbccdb65871. There were
too many other changes accidentally mixed in.

Sponsored by: Netflix

cdefs: Remove __func__ define

We require an ANSI-C compiler to build the base system. It's required
that __func__ work. Remove this define since the only known problem
compilers are ancient history (gcc 2.6 from 1994, almost pre-dating the
project). 3rd party code that used this define will now need to provide
it via some other means when using non-ansi-c compilers.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Move GNUC_PREREQ to top of file

It really should be closer to the the top of the file, so move it to the
start of the compiler specific section.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Remove CC_SUPPORTS macros, they are unused

Remove __CC_SUPPORTS_INLINE, __CC_SUPPORTS___INLINE__,
__CC_SUPPORTS___FUNC__, __CC_SUPPORTS_WARNING,
__CC_SUPPORTS_VARADIC_XXX, __CC_SUPPORTS_DYNAMIC_ARRAY_INIT: they are
unused. Also remove them from the generated cryptodevh.py script.

Retain, for the moment, __CC_SUPPORTS___INLINE, since it's used in this
file.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Remove some builtin defines, they are unused

Remove __GNUCLIKE_BUILTIN_NEXT_ARG, __GNUCLIKE_MATH_BUILTIN_RELOPS,
__GNUCLIKE_BUILTIN_MEMCPY: they are unused. Also remove them from the
generated cryptodevh.py script.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Remove vararg related defines, they are unused.

Remove __GNUCLIKE_BUILTIN_VARARGS, __GNUCLIKE_BUILTIN_STDARG,
__GNUCLIKE_BUILTIN_VAALIST, __GNUC_VA_LIST_COMPATIBILITY: they are
unused. Also remove them from the generated cryptodevh.py script.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Remove __GNUCLIKE_BUILTIN_CONSTANT_P, it's unused

__GNUCLIKE_BUILTIN_CONSTANT_P is unused, remove it. Also remove it from
the generated cryptodevh.py script.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Remove __GNUCLIKE_CTOR_SECTION_HANDLING, it's unused

__GNUCLIKE_CTOR_SECTION_HANDLING is unused, remove it. Also remove it
from the generated cryptodevh.py script.

PR: 275221 (exp-run)
Sponsored by: Netflix

cdefs: Remove __GNUCLIKE___SECTION, it's unused.

__GNUCLIKE___SECTION is unused, remove it. Also remove it from the
generated cryptodevh.py script.

PR: 275221 (exp-run)
Sponsored by: Netflix

sys: Remove ancient SCCS tags.

Remove ancient SCCS tags from the tree, automated scripting, with two
minor fixup to keep things compiling. All the common forms in the tree
were removed with a perl script.

Sponsored by: Netflix

cdefs: remove __GNUCLIKE_MATH_BUILTIN_CONSTANTS

Exp Run PR: 275123
Sponsored by: Netflix

cdefs: Remove __GNUCLIKE_ASM

It's no longer used in the tree.

Exp Run PR: 275123
Sponsored by: Netflix

cdefs: Remove __GNUCLIKE___TYPEOF from cdefs.h

It's been unused for quite some time, so remove it from sys/cdefs.h.

Exp Run PR: 275123
Sponsored by: Netflix

sys: Remove $FreeBSD$: one-line .c pattern

Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/

sys: Remove $FreeBSD$: one-line .h pattern

Remove /^\s*\*+\s*\$FreeBSD\$.*$\n/

sys/cdefs.h: fix for use __restrict in C++

Newlib shares large parts of <sys/cdefs.h> with FreeBSD and received
this bug report:

https://sourceware.org/pipermail/newlib/2023/020400.html

As an extension, GCC and clang offer C99-style restricted pointers in
C++ mode:
https://gcc.gnu.org/onlinedocs/gcc/Restricted-Pointers.html

We notice that this extension is broken when including newlib headers:
restricted pointers are treated as ordinary pointers.

We traced this to the following section of
newlib/libc/include/sys/cdefs.h:

/*
* GCC 2.95 provides `__restrict' as an extension to C90 to support the
* C99-specific `restrict' type qualifier. We happen to use `__restrict' as
* a way to define the `restrict' type qualifier without disturbing older
* software that is unaware of C99 keywords.
*/
#if !(__GNUC__ == 2 && __GNUC_MINOR__ == 95)
#if !defined(__STDC_VERSION__) || __STDC_VERSION__ < 199901
#define __restrict
#else
#define __restrict restrict
#endif
#endif

While the GCC __restrict extension was indeed introduced in GCC 2.95, it
is not limited to this version; the extension is also not limited to
C90:
https://gcc.gnu.org/gcc-2.95/c++features.html

Rewrite the logic in the header so that __restrict is kept alone when
available.

PR: 272723
MFC after: 1 week

<sys/cdefs.h>: Decay expression passed to fallback version of __generic()

This ensures that __generic() more closely matches _Generic() when
using the fallback version when _Generic() is not available (such as
GCC).

Co-authored by: jrtc27
Reviewed by: jrtc27
Differential Revision: https://reviews.freebsd.org/D38215

arm64: Disable per-thread stack-smashing protection in data_abort()

With PERTHREAD_SSP configured, the compiler's stack-smashing protection
uses a per-thread canary value instead of a global value. The value is
stored in td->td_md.md_canary; the sp_el0 register always contains a
pointer to that value, and certain functions selected by the compiler
will store the canary value on the stack as a part of the function
prologue (and will verify the copy as part of the epilogue). In
particular, the thread structure may be accessed.

This happens to occur in data_abort(), which leads to the same problem
addressed by commit 2c10be9e06d4 ("arm64: Handle translation faults for
thread structures"). This commit fixes that directly, by disabling SSP
in data_abort() and a couple of related functions by using a function
attribute. It also moves the update of sp_el0 out of C code in case
the compiler decides to start checking the canary in pmap_switch()
someday.

A different solution might be to move the canary value to the PCB, which
currently lives on the kernel stack and isn't subject to the same
problem as thread structures (if only because guard pages inhibit
superpage promotion). However, there isn't any particular reason the
PCB has to live on the stack today; on amd64 it is embedded in struct
thread, reintroducing the same problem. Keeping the reference canary
value at the top of the stack is also rather dubious since it could be
clobbered by a sufficiently large stack overflow.

A third solution could be to go back to the approach of commit
5aa5420ff2e8, and modify UMA to use the direct map for thread structures
even if KASAN is enabled. But, transient promotions and demotions in
the direct map are possible too.

Reviewed by: alc, kib, andrew
MFC after: 1 month
Sponsored by: Juniper Networks, Inc.
Sponsored by: Klara, Inc.
Differential Revision: https://reviews.freebsd.org/D37255

cdefs: Add some notes about the different versions of POSIX

POSIX versions are a bit weird, so add some notes here.

Sponsored by: Netflix

cdefs.h: Remove redundant #ifdefs

Remove redunant #ifdef __GNUC__ inside an #if defined(__GNUC__)
block. They are nops.

Sponsored by: Netflix

cdefs: Add a default definition for __nosanitizememory

MFC after: 1 week
Sponsored by: The FreeBSD Foundation

cdefs: Make __nosanitizeaddress work for KASAN as well

Add __nosanitizememory while I'm here.

Reviewed by: andrew, kib
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D30126

cdefs.h: Remove __GNUCLIKE___OFFSETOF, it's unused

__GNUCLIKE___OFFSETOF is unreferenced in the tree, remove it as long
obsolete.

Sponsored by: Netflix

headers: Implement _ISOC11_SOURCES macro when __POSIX_C_SOURCE defined

When _ISOC11_SOURCES is defined for glibc at the same time
__POSIX_C_SOURCE is defined, it extends the __POSIX_C_SOURCE definition
by exaclty what C11 adds to the spec for each system header. We follow
both OpenBSD's and glibc's convention by also C11 or higher compliation
mode is selected.

The Open Group is working on issuing a new version of the POSIX standard
that will realign the standard from C99 to a newer version of C. This
commit is a stop-gap measure for greater compatibility until that
environment has been standardized.

Reviewed by: brooks@, arichards@, Olivier Certne
(comments tweaked before commit)
PR: 255290
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D29902

linker_set: fix globl/weak symbol redefinitions to work on clang 12

In clang 12.0.0.rc2, going from weak to global is now a hard error:

```
/usr/src/stand/libsa/amd64/_setjmp.S:67:25: error: _longjmp changed binding to STB_GLOBAL
.text; .p2align 4,0x90; .globl _longjmp; .type _longjmp,@function; _longjmp:; .cfi_startproc
```

And the other way is a warning, but we have -Werror:

```
error: __start_set_Xcommand_set changed binding to STB_WEAK [-Werror,-Winline-asm]
error: __stop_set_Xcommand_set changed binding to STB_WEAK [-Werror,-Winline-asm]
```

ref: https://reviews.llvm.org/D90108

Reviewed By: arichardson
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D29159

Remove __NO_TLS.

All supported platforms support thread-local vars and __thread.

Reviewed by: emaste
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D28796

mips: Don't set __NO_TLS to disable some uses of TLS.

__NO_TLS was originally added to disable use of _Thread in the locale
code in libc in 82dd5016bd749d1d9e1531bd1703aebeecceab34. At the time
libc did not support TLS on MIPS (I believe), but TLS support was
added to libc (at least _set_tp.c) for MIPS about a month after
__NO_TLS was added, but __NO_TLS was still left around.

Reviewed by: imp
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D28713

riscv: Don't set __NO_TLS to disable some uses of TLS.

__NO_TLS was originally added to disable use of _Thread in the locale
code in libc in 82dd5016bd749d1d9e1531bd1703aebeecceab34. The initial
RISC-V import set this for RISC-V presumably due to immaturity in the
toolchains at the time. However, TLS via _Thread works fine in both
GCC and clang on RISC-V.

Reviewed by: mhorne, imp
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D28712

Expose clang's alignment builtins and use them for roundup2/rounddown2

This makes roundup2/rounddown2 type- and const-preserving and allows
using it on pointer types without casting to uintptr_t first. Not
performing pointer-to-integer conversions also helps the compiler's
optimization passes and can therefore result in better code generation.
When using it with integer values there should be no change other than
the compiler checking that the alignment value is a valid power-of-two.

I originally implemented these builtins for CHERI a few years ago and
they have been very useful for CheriBSD. However, they are also useful
for non-CHERI code so I was able to upstream them for Clang 10.0.

Rationale from the clang documentation:
Clang provides builtins to support checking and adjusting alignment
of pointers and integers. These builtins can be used to avoid relying
on implementation-defined behavior of arithmetic on integers derived
from pointers. Additionally, these builtins retain type information
and, unlike bitwise arithmetic, they can perform semantic checking on
the alignment value.

There is also a feature request for GCC, so GCC may also support it in
the future: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98641

Reviewed By: brooks, jhb, imp
Differential Revision: https://reviews.freebsd.org/D28332

cdefs.h: remove intel_compiler support

The age of the intel compiler support is so old as to be
uninteresting. No recent recports of intel compiler support have been
received. Remove all the special case workarounds for the Intel
compiler. Should there be interest in supporting the compiler, contact
me and I'll work with people to make it happen, though I suspect these
instances are more likely to be in the way than to be helpful.

Reviewed by: cem, emaste, vangyzen, dim
Differential Revision: https://reviews.freebsd.org/D26817

Dont let kernel and standalone both be defined at the same time

_KERNEL and _STANDALONE are different things. They cannot both be true
at the same time. If things that are normally visible only to _KERNEL
are needed for the _STANDALONE environment, you need to also make them
visible to _STANDALONE. Often times, this will be just a subset of the
required things for _KERNEL (eg global variables are but one example).

sys/cdefs.h is included by pretty much everything in both the loader
and the kernel, so is the ideal choke point.

amd64: prevent KCSan false positives on LAPIC mapping

For configurations without x2APIC support (guests, older hardware), the global
LAPIC MMIO mapping will trigger false-positive KCSan reports as it will appear
that multiple CPUs are concurrently reading and writing the same address.
This isn't actually true, as the underlying physical access will be performed
on the local CPU's APIC. Additionally, because LAPIC access can happen during
event timer configuration, the resulting KCSan printf can produce a panic due
to attempted recursion on event timer resources.

Add a __nosanitizethread preprocessor define to prevent the compiler from
inserting TSan hooks, and apply it to the x86 LAPIC accessors.

PR: 249149
Reported by: gbe
Reviewed by: andrew, kib
Tested by: gbe
Differential Revision: https://reviews.freebsd.org/D26354

gcc: quiet Wattribute for no_sanitize("address")

This is an unfortunate instance where the __has_attribute check does
not function usefully. Gcc does have the attribute, but for gcc it only
applies to functions, not variables, and trying to apply it to a
variable generates Wattribute. So far we only apply the attribute to
variables. Only enable the attribute for clang, for now.

Reviewed by: Anton Rang <rang at acm.org>
Sponsored by: Dell EMC Isilon
Differential Revision: https://reviews.freebsd.org/D22875

Revert r355760, r355759

And remove the inline/deprecated attribute use entirely in stdlib.h, from
r355747. The intent was to provide a buildable API transitionary period, but
clearly that was counter-productive.

Reported by: delphij, imp, others

cdefs: use more accurate GCC version for the deprecated attribute.

The message argument in the "deprecated" attribute was introduced in GCC 4.5 *.
Use the accurate version number for consistency, as done already with other
attributes.

* https://gcc.gnu.org/onlinedocs/gcc-4.5.0/gcc/Function-Attributes.html

cdefs: Add __deprecated(message) function attribute macro

The legacy version of GCC4 currently in base does not support the
parameterized form of this function attribute, as recent introduced in
stdlib.h (r355747).

As we have done for other function attributes with similar compatibility
problems, add a version-compatibile definition in sys/cdefs.h. Note that
Clang defines itself to be GCC 4, so one must check for __clang__ in
addition to __GNUC__ version. On legacy GCC 4, the macro expands to just
the __deprecated__ attribute; on modern GCC or Clang, the macro expands to
the parameterized variant with the message.

Ignoring legacy or unsupported compilers, the macro is also beneficial in
that it is a bit more ergonomic than the full
__attribute__((__deprecated__())) boilerplate.

Reported by: CI (but not tinderbox); imp and others
Reviewed by: imp
Differential Revision: https://reviews.freebsd.org/D22817

[PowerPC] Enable TLS usage in system libraries on ELFv2.

Currently, __NO_TLS is defined to 1 on powerpc64. TLS usage works much
better on ELFv2 due to the modern tooling, so take the opportunity to
reenable TLS on ELFv2.

If you are using a self-built ELFv2 environment on powerpc64, you will
have to run installworld twice due to RuneLocale changes. This is the only
known regression, and if you are using the ELFv2 isos, you likely already
have the updated libraries installed, as this change is part of the
patchset that the isos integrate.

(No UPDATING note about this because ELFv2 is still an unofficial build.)

Reviewed by: luporl, Alfredo Dal'Ava Junior <alfredo.junior@eldorado.org.br>
Differential Revision: https://reviews.freebsd.org/D22524

Don't sanitize linker_set

The assumptions of linker_set don't play nicely with
AddressSanitizer. AddressSanitizer adds a 'redzone' of zeros around
globals (including those in named sections), whereas linker_set
assumes they are all packed consecutively like a pointer array. So:
let's annotate linker_set so that AddressSanitizer ignores it.

Submitted by: Matthew Bryan <matthew.bryan@isilon.com>
Reviewed by: kib, rang_acm.org
Sponsored by: Dell EMC Isilon
Differential Revision: https://reviews.freebsd.org/D22239

Make the system C11 atomics headers fully compatible with external GCC.

The <sys/cdefs.h> and <stdatomic.h> headers already included support for
C11 atomics via intrinsincs in modern versions of GCC, but these versions
tried to "hide" atomic variables inside a wrapper structure. This wrapper
is not compatible with GCC's internal <stdatomic.h> header, so that if
GCC's <stdatomic.h> was used together with <sys/cdefs.h>, use of C11
atomics would fail to compile. Fix this by not hiding atomic variables
in a structure for modern versions of GCC. The headers already avoid
using a wrapper structure on clang.

Note that this wrapper was only used if C11 was not enabled (e.g.
via -std=c99), so this also fixes compile failures if a modern version
of GCC was used with -std=c11 but with FreeBSD's <stdatomic.h> instead
of GCC's <stdatomic.h> and this change fixes that case as well.

Reported by: Mark Millard
Reviewed by: kib
Differential Revision: https://reviews.freebsd.org/D16585

Drop support for lint for cdefs.h.

Define a new __alloc_size2 attribute to complement the exiting support.

At least on GCC7 calling __alloc_size(x) twice is not equivalent to
calling using the attribute once with two arguments. The later is the
documented use in GCC documentation so add a new alloc_size(n, x)
alternative to cover for the few places where it is used: basically:
calloc(3), reallocarray(3) and mallocarray(9).

Submitted by: Mark Millard
MFC after: 3 days
Reference:
http://docs.freebsd.org/cgi/mid.cgi?F227842D-6BE2-4680-82E7-07906AF61CD7

use @@@ instead of @@ in __sym_default

Using
.symver foo,foo@@VER
causes foo and foo@@VER to be output to the .o file. This requires foo
to be weak since the linker handles foo@@VER as foo.

Using
.symver foo,foo@@@VER
causes just foo@@ver to be output and avoid the need for making foo
weak. It also reduces the constraint on how exactly a linker has to
handle foo and foo@@VER being present.

Submitted by: Rafael Espíndola
Reviewed by: dim, kib
Differential Revision: https://reviews.freebsd.org/D11653

Remove lint support from system headers and MD x86 headers.

Reviewed by: dim, jhb
Discussed with: imp
Sponsored by: The FreeBSD Foundation
Differential revision: https://reviews.freebsd.org/D13156

sys: further adoption of SPDX licensing ID tags.

Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.

Make _Static_assert() work with GCC in older C++ standards.

GCC only activates C11 keywords in C mode, not C++ mode. This means
that when targeting an older C++ standard, we cannot fall back to using
_Static_assert(). In this case, do define _Static_assert() as a macro
that uses a typedef'ed array.

Discussed in: r322875 commit thread
Reported by: Mark MIllard
MFC after: 1 month

o Replace __riscv__ with __riscv
o Replace __riscv64 with (__riscv && __riscv_xlen == 64)

This is required to support new GCC 7.1 compiler.
This is compatible with current GCC 6.1 compiler.

RISC-V is extensible ISA and the idea here is to have built-in define
per each extension, so together with __riscv we will have some subset
of these as well (depending on -march string passed to compiler):

__riscv_compressed
__riscv_atomic
__riscv_mul
__riscv_div
__riscv_muldiv
__riscv_fdiv
__riscv_fsqrt
__riscv_float_abi_soft
__riscv_float_abi_single
__riscv_float_abi_double
__riscv_cmodel_medlow
__riscv_cmodel_medany
__riscv_cmodel_pic
__riscv_xlen

Reviewed by: ngie
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D11901

Implement the memset_s(3) function as specified by the C11 ISO/IEC
9899:2011 Appendix K 3.7.4.1.

Other needed supporting types, defines and constraint_handler
infrastructure is added as specified in the C11 spec.

Submitted by: Tom Rix <trix@juniper.net>
Sponsored by: Juniper Networks
Discussed with: ed
MFC after: 3 weeks
Differential revision: https://reviews.freebsd.org/D9903
Differential revision: https://reviews.freebsd.org/D10161

Renumber copyright clause 4

Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by: Jan Schaumann <jschauma@stevens.edu>
Pull Request: https://github.com/freebsd/freebsd/pull/96

don't use C99 static array indices with older GCC versions

For example, the FreeBSD GCC (4.2.1) has a spotty support for that
feature. If the static keyword is used with an unnamed array parameter
in a function declaration, then the compilation fails with:
error: static or type qualifiers in abstract declarator

The feature does work if the parameter is named.
So, the restriction introduced in this commit can be removed when all
affected function prototypes have the workaround.

MFC after: 1 week
Sponsored by: Panzura

fix a typo in __STDC_VERSION__ in __min_size requirements

MFC after: 1 week
Sponsored by: Panzura

Remove GCC's __nonnull() attribute definition.

While GCC's __nonnull__ attribute is generally useful to prevent misuse of
some functions it also tends to do rather dangerous "optimizations". Now
that we have replaced (r312934) all such uses with the clang nullability
qualifiers, the GCC attribute is unnecessary.

Remove the definition completely to prevent its use in system's headers.

Addition of clang nullability qualifiers.

For consistency with the qualifiers added in r310977, define a new
qualifier _Null_unspecified which is also defined in clang 3.7+.

Add two new macros:
__NULLABILITY_PRAGMA_PUSH
__NULLABILITY_PRAGMA_POP

These are for use in headers when we want avoid noisy warnings if
some pointers are left without nullability annotations.

These are added with way ahead of their first use to teach the GCC
ports headers of their existance before their first use.

Remove unused __gnu_inline() attribute.

This was meant to be used by a future FORTIFY_SOURCE implementation.
Probably for good, FORTIFY_SOURCE and this particular GCCism were never
well supported by clang or other compilers. Furthermore, the technology
has long since been replaced by either static checkers, sanitizers, or
even just the strong stack protector that was enabled by default.

Drop __gnu_inline to avoid cluttering the headers.

MFC after: 5 days

Addition of clang nullability qualifiers.

Add two new qualifiers for use by the static checkers:

_Nonnull
The _Nonnull nullability qualifier indicates that null is not a meaningful
value for a value of the _Nonnull pointer type.

_Nullable
The _Nullable nullability qualifier indicates that a value of the
_Nullable pointer type can be null.

These were introduced in Clang 3.7. For more information, see:
http://clang.llvm.org/docs/AttributeReference.html#nonnull

We add these now without using them so that the GCC ports have time to
pick up the header change.

Hinted by: Android Bionic libc [1]
Also seen in: Apple's Libc-1158.20.4

[1]
https://github.com/android/platform_bionic/commit/baa2a973bd776a51bb05a8590ab05d86eea7b321

Fix C++ includability of crypto headers with static array sizes

C99 allows array function parameters to use the static keyword for their
sizes. This tells the compiler that the parameter will have at least the
specified size, and calling code will fail to compile if that guarantee is
not met. However, this syntax is not legal in C++.

This commit reverts r300824, which worked around the problem for
sys/sys/md5.h only, and introduces a new macro: min_size(). min_size(x) can
be used in headers as a static array size, but will still compile in C++
mode.

Reviewed by: cem, ed
MFC after: 4 weeks
Sponsored by: Spectra Logic Corp
Differential Revision: https://reviews.freebsd.org/D8277

Stop exposing the C11 _Atomic() macro in <sys/cdefs.h>, when compiling
for C++. It clashes with the one in libc++'s <atomic> header.

(Previously, the _Atomic() macro was defined in <stdatomic.h>, which is
only for use with C11, but for various reasons it was moved to its
current location in r251804.)

Discussed with: bdrewery, ed
MFC after: 2 weeks

Include machine/acle-compat.h in cdefs.h on arm if the compiler doesn't
have ACLE support built in. The ACLE (ARM C Language Extensions) defines
a set of standardized symbols which indicate the architecture version and
features available. ACLE support is built in to modern compilers (both
clang and gcc), but absent from gcc prior to 4.4.

ARM (the company) provides the acle-compat.h header file to define the
right symbols for older versions of gcc. Basically, acle-compat.h does
for arm about the same thing cdefs.h does for freebsd: defines
standardized macros that work no matter which compiler you use. If ARM
hadn't provided this file we would have ended up with a big #ifdef __arm__
section in cdefs.h with our own compatibility shims.

Remove #include <machine/acle-compat.h> from the zillion other places (an
ever-growing list) that it appears. Since style(9) requires sys/types.h
or sys/param.h early in the include list, and both of those lead to
including cdefs.h, only a couple special cases still need to include
acle-compat.h directly.

Loves it: imp

Welcome the RISC-V 64-bit kernel.

This is the final step required allowing to compile and to run RISC-V
kernel and userland from HEAD.

RISC-V is a completely open ISA that is freely available to academia
and industry.

Thanks to all the people involved! Special thanks to Andrew Turner,
David Chisnall, Ed Maste, Konstantin Belousov, John Baldwin and
Arun Thomas for their help.
Thanks to Robert Watson for organizing this project.

This project sponsored by UK Higher Education Innovation Fund (HEIF5) and
DARPA CTSRD project at the University of Cambridge Computer Laboratory.

FreeBSD/RISC-V project home: https://wiki.freebsd.org/riscv

Reviewed by: andrew, emaste, kib
Relnotes: Yes
Sponsored by: DARPA, AFRL
Sponsored by: HEIF5
Differential Revision: https://reviews.freebsd.org/D4982

Rename __sentinel to __null_sentinel

GCC 5 uses a conflicting __sentinel definition in include/c++/bits/stl_algo.h

Reported by: matteo

Add underscores to attributes when checking for __has_attribute.

This is a good practice to avoid confusion with allowed macros.

Suggested by: jilles

trailing space

Be more GCC-friendly with attributes

Being clang the default compiler, we were always giving precedence to
the __has_attribute check. Unfortunately clang generally doesn't support
the new attributes (alloc_size was briefly supported and then reverted)
so we were always doing both checks. Give the precedence to GCC as that is
the working case now.

Do the same for __has_builtin() for consistency.

Repair sys/cdefs.h enough to be usable with GCC 5.x

The __alloc_size and __alloc_align need to be defined to
nothingness for lint, but the existing check is deficient
and allows attributes with working __has_attrubute() to
slip through.

cdefs: reduce code duplication

Add a new __sentinel attribute.

The sentinel attribute was originally implemented in OpenBSD's gcc and
later adopted by upstream GCC 4.0 (and clang). From the OpenBSD's
gcc-local manpage:

- gcc recognizes the extra attribute __sentinel__, which can be used to
mark varargs function that need a NULL pointer to mark argument
termination, like execl(3). This exposes latent bugs for 64-bit
architectures, where a terminating 0 will expand to a 32-bit int, and
not a full-fledged 64-bits pointer.

While here sort the visibility attributes.

Hinted-by: OpenBSD

Change detection for the gnu_inline attribute.

According to the GCC documentation:
"This attribute is available in GCC 4.1.3 and later. It is available
if either of the preprocessor macros __GNUC_GNU_INLINE__ or
__GNUC_STDC_INLINE__ are defined."

We don't keep the gcc granularity up to the minor number so it's
better to use the documented way. Current clang defines both
macros.

Reference:
https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#Common-Function-Attributes

Enable the use of __builtin_va_* for ICC.

PR: 198822
Submitted by: Sergey Melnikov <sergey.melnikov@intel.com>
MFC after: 5 days

Rename __weak to __weak_symbol to avoid language conflict with objective-C.

PR: 200972 (exp-run)
Suggested by: theraven@
MFC after: 3 days

Break apart the gnu_inline attribute and use "artificial" if available.

Missing #endif (in wrong place)

Pointed hat: me

Break apart the gnu_inline attribute and use "artificial" if available.

Missing #endif

Reported by: jhb, jenkins
Pointed hat: me

Break apart the gnu_inline attribute and use "artificial" if available.

In general it is bad practice to use the gnu_inline attribute but we
will need it in special cases like FORTIFY_SOURCE. In this specific
case it is also useful to have the "artificial" attribute:

"This attribute is useful for small inline wrappers which if possible
should appear during debugging as a unit, depending on the debug info
format it will either mean marking the function as artificial or using the
caller location for all instructions within the inlined body."

This attribute appears to be currently implemented only in GCC. Use it
only in conjuntion with gnu_inline in the cases where it is available,
which is similar in spirit in how it's used in glibc.

Replace a CONSTCOND for a void value as a replacement for __unreachable builtin

This only applies if we are not using clang or gcc but it lets us use the
__unreachable() buitin in expressions.

Suggested by: tijl

Add new __unreachable() builtin

This is one of the few post gcc4.2 builtins that has been implemented by
clang:

__builtin_unreachable is used to indicate that a specific point in the
program cannot be reached, even if the compiler might otherwise think it
can. This is useful to improve optimization and eliminates certain
warnings.

Hinted by: NetBSD
Differential Revision: https://reviews.freebsd.org/D2536

Adjust visibility macros.

The GCC visibility attributes were introduced in GCC 4.0.
Apparently the "protected" attribute was introduced only
until GCC 4.2, but we are not currently using it.

MFC after: 1 week

Cleanup a bit the clang attributes for type safety checking.

Cleanup r281861 by moving the definitions to their own section but
still leave the definitions out of lint.

In addition to the 'argument_with_type_tag' attribute, bring
'type_tag_for_datatype' which is necessary for annotating the
data types.

Add definition to support alloc_align attribute.

gcc 4.9 added support for new alignment attribute alloc_align:

The alloc_align attribute is used to tell the compiler that the function
return value points to memory, where the returned pointer minimum
alignment is given by one of the functions parameters. GCC uses this
information to improve pointer alignment analysis.

This attribute is not (yet) available on clang.

Add definition for the argument_with_type_tag attribute.

This attribute originates in clang and brings support for checking types
of variadic functions' arguments for functions like fcntl() and ioctl().

Unfortunately lint(1) will complain about them: in particular as one of
the parameters is the function being tagged. For now define this attribute
in the lint-sensitive section.

Reference:
http://clang.llvm.org/docs/AttributeReference.html#type-safety-checking

Add definition for the gcc gnu_inline attribute.

This uses a non-standard (who would guess that) inlining method
that is useful for legacy GNU software. This attribute was added
in GCC 4.1.3. Older versions of clang would just ignore the
attribute but as lately it is supported also there.

This is currently unused but it is required for the
FORTIFY_SOURCE extension.

cdefs.h: Fix macros for pre-C99 compilers.

Older compilers, and compatibility modes, may not support variadic macros.
I normally wouldn't go out of my way to support those old compilers but
there is a prescendent in other system headers for using the same macro
multiple times, and the solution (although non-elegant IMHO) works.

Requested by: bde
Solution by: tijl

Fix __size_alloc()

Use underscore for the attributes name: this should fix the use of the
attributes in macros for lint(1).

Suggested by: bde

X-MFC with: r280700

Introduce some allocation function attributes.

Bring support for two gcc function attributes that are likely to be used
in our system headers:

__alloc_size
The alloc_size attribute is used to tell the compiler that the function
return value points to memory, where the size is given by one or two of
the functions parameters.

__result_use_check
Causes a warning to be emitted if a caller of the function with this
attribute does not use its return value. This is known in gcc as
"warn_unused_result" but we considered the original naming unsuitable
for an attribute.

The __alloc_size attribute required some workarounds for lint(1).
Both attributes are supported by clang.

Also see: D2107

MFC after: 3 days

Small style(9) cleanup.

Fix yet more issues, but certainly not all.

Pointed out by: bde

Small style(9) cleanup.

#define should always be followed by a tab not space.

Permit multiple arguments for the nonnull attribute.

This is very useful for non-trivial functions and doesn't
affect existing uses.

MFC after: 5 days

Mark typedefs for manually implementing _Static_assert() as unused, so
they won't show up unecessarily for -Wunused-local-typedefs.

MFC after: 3 days

Ensure that lint does not pick up C11 keywords (e.g. _Noreturn), even
if C11 mode is used. It does not support any C11 constructs.

MFC after: 3 days

For gcc 4.6 and newer, _Static_assert is a keyword, so don't try to
redefine it. It does what we want, and is always available unlike
other alternatives.

Roll back r271012 even more aggressively.

I've looked at the GCC sources and I now understand what's going wrong.
THe C11 keywords are simply nonexistent when using C++ mode. They are
marked as C-only in the parser. This is absolutely impractical for
multiple reasons:

- The C11 keywords do not conflict with C++ naming rules. They all start
with _[A-Z]. There is no reason to make them C-only.

- It makes it practically impossible for people to use these keywords in
C header files and expect them to work from within C++ sources.

As I said in my previous commit message: GCC is by far the weirdest
compiler that I've ever used.

Partially revert r271012.

Incredibly weird: GCC 4.7/4.9 do support the _Noreturn and _Thread_local
keywords, but not during bootstrapping. GCC is by far the weirdest
compiler that I've ever used.

Reported by: andreast@

Leave the C11 keywords alone when we have a recent version of GCC.

As GCC also gained support for the C11 keywords over time, we can patch
up <sys/cdefs.h> to not define these anymore. This has the advantage
that error messages for static assertions are printed natively and that
_Alignas() will work with even a type outside of C11 mode.

All C11 keywords are supported with GCC 4.7 and higher, with the
exception of _Thread_local and _Generic. These are only supported as of
GCC 4.9.

Partially revert r270964. Don't test for C++11 to define _Thread_local.

In addition to Clang 3.3, it turns out that GCC 4.7 in Ports also does
not support the _Thread_local keyword. Let's document this in a bit more
detail.

Reported by: antoine@

Clean up <sys/cdefs.h> slightly.

- Remove c++0x hack from <sys/cdefs.h> that was needed when Clang did
not fully implement C++11. We can now safely test against C++11 to
check whether thread_local is available, like we do for all other
C++11 keywords.

- Don't use __clang__ to test for thread safety annotation presence. It
turns out we have a proper attribute for this.

Enable lock annotations on HEAD when using Clang.

MFC after: never

Add lock annotations to <sys/cdefs.h>.

Clang has support for annotating mutexes and code that uses mutexes to
validate certain aspects of thread safety:

- Whether acquiring/releasing locks is done properly (e.g., whether you
unlock a mutex before leaving a function).
- Whether a lock is held while reading/writing data from/to memory.

Analysis is performed at the function level. Functions can be annotated
to indicate they:

- (try to) pick up a lock,
- release a lock,
- can only be called when (not) holding a lock,
- assert that a lock is held.

Variables and structure members can be annotated to indicate that they
are guarded by a certain lock. In C++, these annotations can refer
to both global variables, but also other class/structure members. In C,
it is only possible to refer to global variables.

This change adds wrappers for the annotations used by Clang to
<sys/cdefs.h>. They currently have no effect, but this is on purpose.
This change will be merged back to FreeBSD 9 and 10, which means we can
safely experiment with these annotations on HEAD without making it
harder to port changes back.

Reviewed by: announced on arch@ and toolchain@
MFC after: 3 weeks

Define a "__weak" macro for declaring symbols "weak".

Move _Atomic() into <sys/cdefs.h>.

That way _Atomic() is defined next to all the other C11 keywords for
which we provide compatibility for pre-C11 compilers. While there, fix
the definition to place "volatile" at the end. Otherwise pointer types
will become "volatile T *" instead of "T * volatile".

Remove lint case for _Thread_local.

I added this block, knowing that lint does not support _Thread_local.
When linting, we could argue that we don't care about TLS (yet). It
seems, however, that external pieces of software also sometimes do a
-Dlint, regex the output and compile it again.

Reported by: swills

Rework the way C11 keywords are defined.

Instead of only checking the __STDC_VERSION__, we can also use Clang's
__has_extension() to check for features specifically. This allows us to,
say, use Clang's native _Static_assert() instead of the typedef hack,
making the compiler error messages a lot more readable.

Reviewed by: theraven

Add an unified macro to deny ability from the compiler to reorder
instruction loads/stores at its will.
The macro __compiler_membar() is currently supported for both gcc and
clang, but kernel compilation will fail otherwise.

Reviewed by: bde, kib
Discussed with: dim, theraven
MFC after: 2 weeks

Define clang feature test macro __has_extension. It's used in stdatomic.h.

Rename __member2struct() to __containerof().

Compared to __member2struct(), this macro has the following advantages:

- It ensures that the type of the pointer is compatible with the member
field of the structure (or a void pointer).
- It works properly in combination with volatile and const, though
unfortunately it drops these qualifiers from the returned value.

mdf@ proposed to add the container_of() macro, just like Linux has.
Eventually I decided against this, as <sys/param.h> is included all over
the place. It seems container_of() on Linux is specific to the kernel,
not userspace. I'd rather not pollute userspace with this.

I also thought about adding __container_of(), but this would have two
advantages. Xorg seems to already have a __container_of(), which is not
compatible with this version. Also, the underscore in the middle
conflicts with our existing macros (__offsetof, __rangeof, etc).

I'm changing member2struct() to use its old code, as the extra
strictness of this new macro conflicts with existing code (read: cxgb).

MFC after: 1 month

Implement LIST_PREV().

Regular LISTs have been implemented in such a way that the prev-pointer
does not point to the previous element, but to the next-pointer stored
in the previous element. This is done to simplify LIST_REMOVE(). This
macro can be implemented without knowing the address of the list head.

Unfortunately this makes it harder to implement LIST_PREV(), which is
why this macro was never here. Still, it is possible to implement this
macro. If the prev-pointer points to the list head, we return NULL.
Otherwise we simply subtract the offset of the prev-pointer within the
structure.

It's not as efficient as traversing forward of course, but in practice
it shouldn't be that bad. In almost all use cases, people will want to
compare the value returned by LIST_PREV() against NULL, so an optimizing
compiler will not emit code that does more branching than TAILQs.

While there, make the code a bit more readable by introducing
__member2struct(). This makes STAILQ_LAST() far more readable.

MFC after: 1 month

Add a convenience macro for the fastcall attribute.

MFC after: 2 weeks

Add a convenience macro for the returns_twice attribute, and apply it to
the prototypes of the appropriate functions (getcontext, savectx,
setjmp, sigsetjmp and vfork).

MFC after: 2 weeks

Reapply 227753 (xlocale cleanup), plus some fixes so that it passes build
universe with gcc.

Approved by: dim (mentor)

Revert r231673 and r231682 for now, until we can run a full make
universe with them. Sorry for the breakage.

Pointy hat to: me and brooks

Cleanup of xlocale:

- Address performance regressions encountered by das@ by caching per-thread
data in TLS where available.
- Add a __NO_TLS flag to cdefs.h to indicate where not available.
- Reorganise the xlocale.h definitions into xlocale/*.h so that they can be
included from multiple places.
- Export the POSIX2008 subset of xlocale when POSIX2008 says it should be
exported, independently of whether xlocale.h is included.
- Fix the bug where programs using ctype functions always assumed ASCII unless
recompiled.
- Fix some style(9) violations.

Reviewed by: brooks (mentor)
Approved by: dim (mentor)

Don't expose __generic() when not using C++.

According to the GCC documentation, the constructs used to implement
<tgmath.h> are only available in C mode. They only cause breakage when
used used with g++.

Reported by: tijl

Add __generic(), to be able to use a very simple _Generic().

Already introducing this allows us to be forward compatible with C11
compilers. By implementing <tgmath.h> on top of this interface, it
becomes trivial to support both our existing GCC and newer compilers.

Add cdefs-magic to add optional C11 bits to headers.

The standard is now called C11 -- C12.

While there, compare against the proper __STDC_VERSION value.

Some GCC-compatibility definitions. Define clang's feature test pseudomacros
to always evaluate to 0 if we are using a compiler that doesn't implement them.
This lets us use the macros easily in standard headers (e.g. stdatomic.h, which
should be the subject of my next commit).

Approved by: dim (mentor)

Fix typo in macro.

I copied this macro directly from Bruce's email, as I assumed it was
awesome already.

Reported by: tijl@

Process a lot of feedback from bde@ on <sys/cdefs.h>:

- Add __alignof() for non-GCC and GCC < 2.95.
- Simply implement the C1X keywords on top of the existing __macros.
- Add struct __hack to _Static_assert to require consumers to add a
semicolon.
- Add an extra underscore to __assert_ to allow it to be combined with
locally defined versions of CTASSERT in the tree.
- Add proper casts to __offsetof() to make it work for cases where
sizeof(size_t) != sizeof(uintptr_t).
- Globally replace size_t and uintptr_t by __size_t and __uintptr_t.
This removes the dependency on <sys/types.h> / <stdint.h>. Practically
any header file ends up including <machines/_types.h> somehow.
- Change argument names of macros to match with the rest of the file.

MFC after: 3 months

Slightly alter the C1X definitions in in cdefs.h:

- Add _Alignas(). Unfortunately this macro is only partially functional.
The C1X standard will allow both an integer and a type name to be
passed to this macro, while this macro only allows an integer. To be
portable, one must use _Alignas(_Alignof(double)) to use type names.

- Don't do _Static_assert() when __COUNTER__ is not supported. We'd
better keep this implementation robust and allow it to be used in
header files, without mysteriously breaking older compilers.

Make support for C1X keywords more complete.

- _Alignof(), which returns the aligment of a certain type.
- _Static_assert(), which can be used to check compile-time assertions.
- _Thread_local, which uses TLS on a variable.

MFC after: 3 months
Reviewed by: mdf

As per das@'s suggestion, s/__noreturn/_Noreturn/, since the latter is an
identifier reserved for the implementation in C99 and earlier so there is
no sensible reason for introducing yet another reserved identifier when we
could just use the one C1x uses.

Approved by: brooks (mentor)

Implement quick_exit() / at_quick_exit() from C++11 / C1x. Also add a
__noreturn macro and modify the other exiting functions to use it.

The __noreturn macro, unlike __dead2, must be used BEFORE the function.
This is in line with the C and C++ specifications that place _Noreturn (c1x)
and [[noreturn]] (C++11) in front of the functions. As with __dead2, this
macro falls back to using the GCC attribute.

Unfortunately, clang currently sets the same value for the C version macro
in C99 and C1x modes, so these functions are hidden by default. At some
point before 10.0, I need to go through the headers and clean up the C1x /
C++11 visibility.

Reviewed by: brooks (mentor)

Fix kernel build breakage after r227475. I had forgotten kernels are
built with -Wundef, as opposed to world.

Additionally, cdefs.h tends to not use indentation for preprocessor
directives, so remove that too.

Pointy hat to: me

Expose all of the C99 limits.h stuff when we're in C++11 mode (or some approximation thereof). C++11 finally adds long long to C++. Now even C++ programmers are allowed to use 64-bit integers!

Approved by: dim (mentor)

Silence an (otherwise harmless) very recurrent warning when building the
kernel of FreeBSD with a non-FreeBSD compiler.

Approved by: kib (mentor)

Turn off default generation of userland dot symbols on powerpc64 now that
we have a binutils that supports it. Kernel dot symbols remain on to assist
DDB.

On 32 bit architectures define (u)int64_t as (unsigned) long long instead
of (unsigned) int __attribute__((__mode__(__DI__))). This aligns better
with macros such as (U)INT64_C, (U)INT64_MAX, etc. which assume (u)int64_t
has type (unsigned) long long.

The mode attribute was used because long long wasn't standardised until
C99. Nowadays compilers should support long long and use of the mode
attribute is discouraged according to GCC Internals documentation.

The type definition has to be marked with __extension__ to support
compilation with "-std=c89 -pedantic".

Discussed with: bde
Approved by: kib (mentor)

After some off-list discussion, revert a number of changes to the
DPCPU_DEFINE and VNET_DEFINE macros, as these cause problems for various
people working on the affected files. A better long-term solution is
still being considered. This reversal may give some modules empty
set_pcpu or set_vnet sections, but these are harmless.

Changes reverted:

------------------------------------------------------------------------
r215318 | dim | 2010-11-14 21:40:55 +0100 (Sun, 14 Nov 2010) | 4 lines

Instead of unconditionally emitting .globl's for the __start_set_xxx and
__stop_set_xxx symbols, only emit them when the set_vnet or set_pcpu
sections are actually defined.

------------------------------------------------------------------------
r215317 | dim | 2010-11-14 21:38:11 +0100 (Sun, 14 Nov 2010) | 3 lines

Apply the STATIC_VNET_DEFINE and STATIC_DPCPU_DEFINE macros throughout
the tree.

------------------------------------------------------------------------
r215316 | dim | 2010-11-14 21:23:02 +0100 (Sun, 14 Nov 2010) | 2 lines

Add macros to define static instances of VNET_DEFINE and DPCPU_DEFINE.

Instead of unconditionally emitting .globl's for the __start_set_xxx and
__stop_set_xxx symbols, only emit them when the set_vnet or set_pcpu
sections are actually defined.

Revert r103230, which depended on ld preserving the __start_xxx and
__stop_xxx symbols for custom sections, even when these were not
referenced (at link time). This behaviour was changed again in binutils
commit 0b8ed435c3fe8bd09a08c23920e65bfb03251221.

This time, put the __GLOBL macro definition in cdefs.h, so it can be
reused in a few other places where it will be needed.

Reviewed by: kib

A new jail(8) with a configuration file, to replace the work currently done
by /etc/rc.d/jail.

Use private namespace for visibility keyword.

Noted by: bde
MFC after: 3 days

Use preferred spelling for the __attribute__.

MFC after: 3 days

Add convenience defines for hidden and default/exported attributes.

MFC after: 2 weeks

Revert r210225 - turns out I was wrong; the "/*-" is not license-only
thing; it's also used to indicate that the comment should not be automatically
rewrapped.

Explained by: cperciva@

The "/*-" comment marker is supposed to denote copyrights. Remove non-copyright
occurences from sys/sys/ and sys/kern/.

The 64-bit PowerPC ABI implemented in binutils 2.15 requires some special
quirks for weak-symbol handling. Text symbols require also marking weak
the special dot-symbol associated with the function, and data symbols
require that you not do that. To fix this, provide a hacked
__weak_reference for powerpc64, and define a new __weak_reference_data
for the single weak data symbol in base.

Revert after: binutils 2.17 import
Obtained from: projects/ppc64

Recommit r193732:

Remove __gnu89_inline.

Now that we use C99 almost everywhere, just use C99-style in the pmap
code. Since the pmap code is the only consumer of __gnu89_inline, remove
it from cdefs.h as well. Because the flag was only introduced 17 months
ago, I don't expect any problems.

Reviewed by: alc

It was backed out, because it prevented us from building kernels using a
7.x compiler. Now that most people use 8.x, there is nothing that holds
us back. Even if people run 7.x, they should be able to build a kernel
if they run `make kernel-toolchain' or `make buildworld' first.

Revert my change; reintroduce __gnu89_inline.

It turns out our compiler in stable/7 can't build this code anymore.
Even though my opinion is that those people should just run `make
kernel-toolchain' before building a kernel, I am willing to wait and
commit this after we've branched stable/8.

Requested by: rwatson

Remove __gnu89_inline.

Now that we use C99 almost everywhere, just use C99-style in the pmap
code. Since the pmap code is the only consumer of __gnu89_inline, remove
it from cdefs.h as well. Because the flag was only introduced 17 months
ago, I don't expect any problems.

Reviewed by: alc

Hide __restrict from lint, just like we do with other keywords.

Unlike GCC, LLVM defines __STDC_VERSION__ to 199901L by default. This
means `restrict' keywords in files end up being given to lint, which
results in errors during compilation of usr.bin/xlint.

Other keywords are also expanded to nothing when using lint, so do the
same with restrict.

Fix a typo in the previous commit.

Submitted by: Mel <mel@rachie.is-a-geek.net>

Add visibility constants for POSIX.1-2008.

Add a function attribute called `__malloc_like', which informs gcc
that the annotated function returns a pointer that doesn't alias any
extant pointer. This results in a 50%+ speedup in microbenchmarks such
as the following:

char *cp = malloc(1), *buf = malloc(BUF);
for (i = 0; i < BUF; i++) buf[i] = *cp;

In real programs, your mileage will vary. Note that gcc already
performs this optimization automatically for any function called
`malloc', `calloc', `strdup', or `strndup' unless -fno-builtins is
used.

Remove __CC_INT_IS_32BIT define which was used to fix mpt driver
but is not used anymore. This define is not referenced by anything
in the FreeBSD srcs nor google shows any usage. Kernel and world
builds fine without it.

Approved by: kib (mentor)

- Import the HEAD csup code which is the basis for the cvsmode work.

add __noinline

Submitted by: imp
Reviewed by: kan (long ago)
MFC after: 3 weeks

Eliminate compilation warnings due to the use of non-static inlines
through the introduction and use of the __gnu89_inline attribute.

Submitted by: bde (i386)
MFC after: 3 days

Use __builtin_offsetof for GCC 4.1.

Add macros for generating symbol version assembler opcodes.

Analogous to __printflike and __scanflike, add the macro __format_arg which
expands to the GCC format_arg attribute if supported.

This fixes a syntax error in <nl_types.h> for compilers/tools not
implementing the GCC __attribute__ extensions.

Don't use the builtin vaalist for icc.

Submitted by: Igor Sysoev <is@rambler-co.ru>
MFC after: 3 days

Remove superfluous semicolon at the end of the __strong_reference() macro
definition.

Use predefined __offsetof__ builtin function when compiling C++ sources.

The macros __GNUCLIKE_ATTRIBUTE_PRINTF and
__CC_SUPPORTS_FORWARD_REFERENCE_CONSTRUCT are no longer needed, remove them.

netchild's mega-patch to isolate compiler dependencies into a central
place.

This moves the dependency on GCC's and other compiler's features into
the central sys/cdefs.h file, while the individual source files can
then refer to #ifdef __COMPILER_FEATURE_FOO where they by now used to
refer to #if __GNUC__ > 3.1415 && __BARC__ <= 42.

By now, GCC and ICC (the Intel compiler) have been actively tested on
IA32 platforms by netchild. Extension to other compilers is supposed
to be possible, of course.

Submitted by: netchild
Reviewed by: various developers on arch@, some time ago

/* -> /*- for license, minor formatting changes

Add a macro to define the size of a subsection of a structure.
Used in fork1() and thr_create()

Introduce __used attribute which serves as logical conuterpart of
preexisting __unused.

Add a macro, __pure, which expands to __attribute__((__pure__)) on gcc
versions that support it (>=2.96). This is similar to but not the same
as the __pure macro that was removed in rev. 1.21.

Remove advertising clause from University of California Regent's license,
per letter dated July 22, 1999.

Approved by: core

These are changes to allow to use the Intel C/C++ compiler (lang/icc)
to build the kernel. It doesn't affect the operation if gcc.

Most of the changes are just adding __INTEL_COMPILER to #ifdef's, as
icc v8 may define __GNUC__ some parts may look strange but are
necessary.

Additional changes:
- in_cksum.[ch]:
* use a generic C version instead of the assembly version in the !gcc
case (ASM code breaks with the optimizations icc does)
-> no bad checksums with an icc compiled kernel
Help from: andre, grehan, das
Stolen from: alpha version via ppc version
The entire checksum code should IMHO be replaced with the DragonFly
version (because it isn't guaranteed future revisions of gcc will
include similar optimizations) as in:
---snip---
Revision Changes Path
1.12 +1 -0 src/sys/conf/files.i386
1.4 +142 -558 src/sys/i386/i386/in_cksum.c
1.5 +33 -69 src/sys/i386/include/in_cksum.h
1.5 +2 -0 src/sys/netinet/igmp.c
1.6 +0 -1 src/sys/netinet/in.h
1.6 +2 -0 src/sys/netinet/ip_icmp.c

1.4 +3 -4 src/contrib/ipfilter/ip_compat.h
1.3 +1 -2 src/sbin/natd/icmp.c
1.4 +0 -1 src/sbin/natd/natd.c
1.48 +1 -0 src/sys/conf/files
1.2 +0 -1 src/sys/conf/files.amd64
1.13 +0 -1 src/sys/conf/files.i386
1.5 +0 -1 src/sys/conf/files.pc98
1.7 +1 -1 src/sys/contrib/ipfilter/netinet/fil.c
1.10 +2 -3 src/sys/contrib/ipfilter/netinet/ip_compat.h
1.10 +1 -1 src/sys/contrib/ipfilter/netinet/ip_fil.c
1.7 +1 -1 src/sys/dev/netif/txp/if_txp.c
1.7 +1 -1 src/sys/net/ip_mroute/ip_mroute.c
1.7 +1 -2 src/sys/net/ipfw/ip_fw2.c
1.6 +1 -2 src/sys/netinet/igmp.c
1.4 +158 -116 src/sys/netinet/in_cksum.c
1.6 +1 -1 src/sys/netinet/ip_gre.c
1.7 +1 -2 src/sys/netinet/ip_icmp.c
1.10 +1 -1 src/sys/netinet/ip_input.c
1.10 +1 -2 src/sys/netinet/ip_output.c
1.13 +1 -2 src/sys/netinet/tcp_input.c
1.9 +1 -2 src/sys/netinet/tcp_output.c
1.10 +1 -1 src/sys/netinet/tcp_subr.c
1.10 +1 -1 src/sys/netinet/tcp_syncache.c
1.9 +1 -2 src/sys/netinet/udp_usrreq.c

1.5 +1 -2 src/sys/netinet6/ipsec.c
1.5 +1 -2 src/sys/netproto/ipsec/ipsec.c
1.5 +1 -1 src/sys/netproto/ipsec/ipsec_input.c
1.4 +1 -2 src/sys/netproto/ipsec/ipsec_output.c

and finally remove
sys/i386/i386 in_cksum.c
sys/i386/include in_cksum.h
---snip---
- endian.h:
* DTRT in C++ mode
- quad.h:
* we don't use gcc v1 anymore, remove support for it
Suggested by: bde (long ago)
- assym.h:
* avoid zero-length arrays (remove dependency on a gcc specific
feature)
This change changes the contents of the object file, but as it's
only used to generate some values for a header, and the generator
knows how to handle this, there's no impact in the gcc case.
Explained by: bde
Submitted by: Marius Strobl <marius@alchemy.franken.de>
- aicasm.c:
* minor change to teach it about the way icc spells "-nostdinc"
Not approved by: gibbs (no reply to my mail)
- bump __FreeBSD_version (lang/icc needs to know about the changes)

Incarnations of this patch survive gcc compiles since a loooong time,
I use it on my desktop. An icc compiled kernel works since Nov. 2003
(exceptions: snd_* if used as modules), it survives a build of the
entire ports collection with icc.

Parts of this commit contains suggestions or submissions from
Marius Strobl <marius@alchemy.franken.de>.

Reviewed by: -arch
Submitted by: netchild

While not illegal, attempt to pacify gcc -Wundef. It just so happens
that libtool-using packages seem to love using this flag.

/usr/include/sys/cdefs.h:184:5: warning: "__STDC_VERSION__" is not defined
/usr/include/sys/cdefs.h:372:5: warning: "_POSIX_C_SOURCE" is not defined
/usr/include/sys/cdefs.h:378:5: warning: "_POSIX_C_SOURCE" is not defined

Remove extra parentheses from the __GNUC_PREREQ__ macro.

Prodded by: bde

Introduce new __predict_false(exp) and __predict_true(exp) keywords.
Their purpose is to give explicit hints to the compiler to judge
the likelyhood of a test to succeed or fail. Not all architectures
have support for such optimizations, but for those who do, it can
give a nice performance improvement in hot loops.

Obviously, this should be used very rarely in very specific code.

Reviewed by: peter
Obtained from: OpenBSD

Define a new __GNUC_PREREQ__(maj, min) to test if we have a specific
version of GCC or later and use it where appropriate. It makes this
file more readable.

Obtained from: OpenBSD

Discussions on src-committers with alfred and bde pointed out that
the "do-nothing" versions of __RCSID(), __RCSID_SOURCE(), __SCCSID(),
and __COPYRIGHT() were not strictly correct. They should not expand
into [nothing], because the ';' which follows them would then cause
a syntax error (in a strict C compiler, if not gcc...).

So, change the do-nothing versions of those macros to use the
'struct __hack' tactic, as was already used with __FBSDID().

Approved by: discussions with bde
MFC after: 1 week

Attempt to preempt any new gcc-ism references to
__attribute__((__always_inline__)) by adding an __always_inline macro
(used like __dead2 etc). __inline_damnit has also been suggested but we
have a precedent of keeping the names similar so they are easier to find.

There is strong reason to believe that gcc 4 will also support
__attribute__((__nonnull__(x)), assume it so.

Add a new macro __nonnull(x) to use the new GCC33 attribute which checks
that an argument is not a NULL pointer.

Apply various obvious places.

I belive __printf*() implies __nonnull() so it is not needed on functions
already tagged that way.

Remove the definition of alloca(), it does not belong here.

Use GCC's internal built-in alloca implementation, when available.

Submitted by: DES

Backed out rev.1.57. This restores format checking functions like
err() again. All known err() format errors in src that developed
while format checking was broken have been fixed. Tested on i386,
alpha, ia64.

Add the ability to specify a strict C99 environment with the
_C99_SOURCE constant, which should be defined before including any
standard headers.

Fix a spelling error in a comment.

Submitted by: Craig Rodrigues <rodrigc@attbi.com>

Alfred got me thinking. Provide stubs for lint, and let the compilers
themselves cause a failure if it is told to use a __widget that there is
no implementation for them. missing an implementation for __unused etc is
harmless. But not having a __packed implementation when the kernel code
really needs it is a big deal.

I cannot win. I still managed to use #define<space> twice instead of
#define<tab> in spite of trying to make sure I didn't do this.

Add a __section(x) macro as well. Use this in linker_set.h. ie:
static void const * const __set_##set##_sym_##sym
__attribute__((__section__("set_" #set),__unused__)) = &sym
becomes:
static void const * const __set_##set##_sym_##sym
__section("set_" #set) __unused = &sym
Like the other macros, these #define away for unrecognized compilers or
lint.

Also, fix the argments in the previous commit for the non-gcc case. lint
might be a bit happier about that. Note that the gcc <= 2.6 case
needs some research.

At great personal risk, add a __packed and __aligned(x) define that
expand to __attribute__((packed)) and __attribute__((aligned(x)))
respectively. Replace the handful of gcc-ism's that use
__attribute__((aligned(16))) etc around the kernel with __aligned(16).

There are over 400 __attribute__((packed)) to deal with, that can come
later. I just want to use __packed in new code rather than add more
gcc-ism's.

Initiate deorbit burn for the i386-only a.out related support. Moves are
under way to move the remnants of the a.out toolchain to ports. As the
comment in src/Makefile said, this stuff is deprecated and one should not
expect this to remain beyond 4.0-REL. It has already lasted WAY beyond
that.

Notable exceptions:
gcc - I have not touched the a.out generation stuff there.
ldd/ldconfig - still have some code to interface with a.out rtld.
old as/ld/etc - I have not removed these yet, pending their move to ports.
some includes - necessary for ldd/ldconfig for now.

Tested on: i386 (extensively), alpha

Reformat an overly-wide comment.

Define __LONG_LONG_SUPPORTED if the compiler claims to support C99.
Don't set __LONG_LONG_SUPPORTED for gcc-1. I didn't check exactly
when gcc started to support long long, but it was in the version
of gcc in FreeBSD-1.0 (gcc-2.4.5).

Other C99 features should be ifdefed similarly, but the ifdefs for
old versions of gcc will be more complicated since the features
weren't in all versions of gcc-2.

Identify the C Language Binding Option of IEEE Std. 1003.2-1992.
This represents the original standardization of the following functions
and headers:

popen()
<regex.h>: regcomp(), regexec(), regerror(), regfree()
<fnmatch.h>: fnmatch()
getopt(), optarg, optind, opterr, optopt
<glob.h>: glob()
<wordexp.h>: wordexp(), wordfree()
confstr()

Typo.

Disable format checking for NULL-passing prototypes (really only err*(),
warn*(), and setproctitle() functions) to buildworld work again. This
can be cleaned up later if/when a new GCC supports the feature (but personally
I think it's a waste of time to keep mod'ing imported GCC sources for this
since only three procedures are involved).

Suggested by: peter

Move __offsetof() macro from <machine/ansi.h> to <sys/cdefs.h>. It's
hardly MD, since all our platforms share the same macro. It's not
really compiler dependent either, but this helps in reducing
<machine/ansi.h> to only type definitions.

Backout 1.54 (restore definition for printf0 to actually do something).

As a temporary bandaid disable '__printf0like' unconditionally, it
doesn't seem to work under gcc 3.1 yet.

We are now 'WERROR' safe again.

Make the previous revision work a little bit better.

Add __SCCSID. And add the NO__SCCSID, NO__RCSID, NO__RCSID_SOURCE, and
NO__COPYRIGHT knobs to more easily deal with imported vendor sources.

Deal with "#define _XOPEN_SOURCE" in header files (eg: XFree86 4.2.0)
which caused a syntax error here:
#if _XOPEN_SOURCE >= 600
etc. This is a hack, but I have seen things like it around elsewhere.

Tested by: dwcjr

Implement a fine-grain control system which allows header developers
to control the exposure of macros and prototypes depending upon the
POSIX, X/Open, or ISO C version an application has requested.

Submitted by: wollman
Reviewed by: bde, imp

Back out rev 1.48. The problem is with a bogus __attribute__ in stdio.h.

Reapply rev 1.37 (hide the __attribute__ gcc keyword) into RELENG_4 even
though it was backed out.
With out this change the TenDRA compiler is not bootstrapable.

Add support for the `restrict' type qualifier, new in C99.

Reviewed by: wollman

Add the ability to distinguish between compile environments that
support `long long' and those that don't.

Reviewed by: bde

Use a more sophisticated check that works better with older versions
of GCC when setting __func__ to NULL. This also better supports GCC
when using C++. Move the definition to a better location.

Submitted by: bde

Only provide function information in compile environments that support
the C99 variable __func__ and never for C++. Provide a more meaningful
example in the assert(3) manual.

Reviewed by: asmodai, bde

Solve our braindead sourcetree dependency on GCC in another way.

Discussed with: bde

Avoid empty decls when __FBSDIDs are turned off.

Suggested by: bde
MFC after: 1 week

Fix the improper backout.

Back out rev 1.38. Even though it saves a little space on the line,
it confuses indent(1).

Requested by: bde

Allow __FBSDID() to be used without ;

Add __FBSDID() macro to support rcs identifiers in source files.

For old gcc/gcc-based compilers and non gcc compilers make sure to
hide the __attribute__ gcc keyword.

Reviewed and helped by: peter

style(9) correct #define's followed by a space to be followed by a tab
instead.

MFC after: 2 weeks

It is the last-second trivial changes that kill me every time.
Fix nested comment. :-(

Submitted by: obrien

Attempt to refine the __IDSTRING() macros so that they dont collide with
each other. This will allow multiple __RCSID() entries in the same file
and even __RCSID() in headers. **HOWEVER**, the usefulness of this in
headers is somewhat marginal in non-ELF since they would go into the
data section where they cannot be easily compressed or stripped.
It (id's in headers) is also not useful in the non-GCC case since it is
hard to generate unique variable names. I have an idea on that though.

Now for mcs: http://mirrors.ccs.neu.edu/cgi-bin/unixhelp/man-cgi?mcs+1

Support GCC 3.0

after discovering that the Santa Clara Valley Medical Center actually
has a burn unit and is only 8 miles away...

add __DECONST(), __DEVOLATILE(), and __DEQUALIFY()

Back out a controverial commit.

MFS: rev 1.28.2.2 - Support GCC 3.0.

Use __alias__ instead of alias in the definition of __strong_reference().

Submitted by: jdp

Do not use 'alias' as a macro parameter name for __strong_reference(),
since the word 'alias' appears in the macro body.

Approved by: jkh

Add __strong_reference().

If using GNUC and ELF, make __IDSTRING() expand into an inline asm
statement to put the rcsid into the .comment section. This allows
the comments (ie:version id's of compiler, headers, source, etc) to be
stripped out with the standard tools (strip/objcopy). SVR4 has a
tool called 'mcs' (manipulate comment section) which allows you to
add/remove/compact strings. Removing duplicate strings helps a lot
if the headers generate them.
Using __attribute__((section(".comment"))) would probably also work,
but that still leaves the RCSID occupying C name space somewhere.

$Id$ -> $FreeBSD$

Per request from ache, change the numbering scheme of __FreeBSD_cc_version.
Its form is now like __FreeBSD_version, with the FreeBSD revision in
the top digits.

Make the definition of __printf0like() vary according to the value
of __FreeBSD_cc_version, so that its use is safe with older compilers
and with non-FreeBSD compilers.

Null-terminate the message for a warning symbol in the __warn_references()
macro for ELF. Ian@cygnus.com says that is the proper way to use
the ".gnu.warning.SYMBOL" sections. However, he has accepted Doug
Rabson's BFD patch anyway.

Removed support for the gcc-2.[0-4] keywords __dead and __pure. They
stopped being used in /usr/src almost 2 years ago.

Don't pretend to support gcc-[3-infinity].

Added __printf0like(). Feature tests for the __printf0__ feature
are problematic, so this can't be used for the err() family yet
- it's only in recent versions of FreeBSD's hacked version of gcc.

Added comments about __unused and __*like().

Make __weak_reference work on the alpha.

Added macros __printflike() and __scanflike() to <sys/cdefs.h>.
Use them to `make gcc -Wformat' check formats for all printf-like
and scanf-like functions in /usr/src except for the err()/warn()
family. err() isn't quite printf-like since its format arg can
legitimately be NULL. syslog() isn't quite printf-like, but gcc
already accepts %m, even for plain printf() when it shouldn't.

ELF versions of __warn_references() and __weak_reference(). Note that this
doesn't work with libc/net/res_stubs.c since gas wants the weak reference
to take place in the same context as the real definition, presumably so
that it can get hold of the symbol typing etc.
However, this doesn't matter for libc/elf since we don't have binaries
that use the old symbol names.

Don't define away __attribute__() for the non-gcc and old-gcc cases.
Using __attribute__() in non-ifdefed code is just wrong if it changes
the semantics, and there is no way to ignore __attribute__() only in
the benign cases.

Don't use __attribute__ in non-ifdefed code here. It was a benign
case, but we already have a macro (__unused) for this case.

Expanded comment about gotchas for __CONCAT() in the non-ANSI case.

Remove extraneous ";" from C++'s version of __END_DECLS.

Found by: TenDRA C++

Bring in NetBSD compatible & augmented RCSID/COPYRIGHT macros

Make the necessary changes so that an ELF kernel can be built. I
have successfully built, booted, and run a number of different ELF
kernel configurations, including GENERIC. LINT also builds and
links cleanly, though I have not tried to boot it.

The impact on developers is virtually nil, except for two things.
All linker sets that might possibly be present in the kernel must be
listed in "sys/i386/i386/setdefs.h". And all C symbols that are
also referenced from assembly language code must be listed in
"sys/i386/include/asnames.h". It so happens that failure to do
these things will have no impact on the a.out kernel. But it will
break the build of the ELF kernel.

The ELF bootloader works, but it is not ready to commit quite yet.

Back out part 1 of the MCFH that changed $Id$ to $FreeBSD$. We are not
ready for it yet.

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Add __unused to the list of __dead, __dead2, __pure, __pure2 etc.

gcc-2.7 has __attribute__((unused)) as a postfix operator on function
arguments to prevent -Wunused from complaining about them. gcc < 2.7
doesn't have anything like this (and doesn't care about it either).

eg:
int foo(bar, baz)
int bar __unused; /* needed because of function pointer typing */
char *baz __unused;
{
return (1);
}

Changed `noreturn' to `__noreturn__' so that all headers don't break if
an application #defines `noreturn'.

Changed one instance of `const' similarly. This is less like to be a
problem since applications shouldn't #define `const', and the common
hack of #defining `const' as nothing gives harmless (?) null attributes
instead of syntax errors.

Fixed comments on #endifs to match code.

Import 4.4BSD-Lite2 onto the vendor branch, note that in the kernel, all
files are off the vendor branch, so this should not change anything.

A "U" marker generally means that the file was not changed in between
the 4.4Lite and Lite-2 releases, and does not need a merge. "C" generally
means that there was a change.
[new sys/syscallargs.h file, to be "cvs rm"ed]

Merge in Lite2: no changes required. Just update CSRG id.
Our changes since Lite1 include all the added functionality of Lite2.
Reviewed by: davidg & bde

Warning and weak reference macros which are used to generate link-time
messages.

Obtained from: NetBSD

Fix __CONCAT() for the ANSI case to work with #define'd args, in
particular, when one of the args is another __CONCAT().

- Fix attribute for __pure2.
- Update name of idempotency identifier in comment to match code.

Made them all idempotent.
Reviewed by:
Submitted by:

Made the kernel compile cleanly with gcc 2.6.0. Thanks go to Bruce
Evans for suggesting a method to detect various versions of gcc.

Added $Id$

The big 4.4BSD Lite to FreeBSD 2.0.0 (Development) patch.

Reviewed by: Rodney W. Grimes
Submitted by: John Dyson and David Greenman

BSD 4.4 Lite Kernel Sources