KASSERT: Make runtime optionality optional

[cem]

Summary

Add an option, KASSERT_PANIC_OPTIONAL, that allows runtime KASSERT() behavior
changes. When this option is not enabled, code that allows KASSERTs to become
optional is not enabled, and all violated assertions cause termination.

The runtime KASSERT behavior was added in r243980.

One important distinction here is that panic has dead2, while kassert_panic
(!KASSERT_PANIC_OPTIONAL) does not. Static analyzers like Coverity understand
dead2 ("attribute((noreturn))"). Without it, KASSERTs went misunderstood,
resulting in many false positives that resulted from violation of program
invariants.

[jhb]

sys/sys/systm.h

216 ↗

(On Diff #47061)

I would perhaps leave panic/vpanic here since we usually group function prototypes in a single place. kassert_panic() is the odd one out, but I don't feel strongly enough to suggest moving kassert_panic() down to here.

[cem]

sys/sys/systm.h

216 ↗

(On Diff #47061)

Unfortunately, leaving them in place produced compiler warnings -> Werrors, at least with GCC xtoolchain.

Placing the definition of KASSERT lower requires even more restructuring to the file — the include sys/kpilite.h on line 113/120 invokes KASSERT, for example.

We could move the entire prototype table up, if that seems preferable, but again it's a much bigger change. Or would use some linker magic to have panic define an alias for kassert_panic? But I'm less keen on that.

[cem]

Thanks everyone for reviewing.

sys/sys/systm.h

216 ↗

(On Diff #47061)

I added an explanatory comment here in the committed version.