cdefs: add bounds-safety annotation macros

[abhijeetsharma2002_gmail.com]

Summary

Define the -fbounds-safety vocabulary (counted_by, sized_by,
__single, the forge escape hatches). Every macro expands to nothing
under compilers without the extension, so the annotated tree builds
unchanged with the stock toolchain.

Sponsored by: The FreeBSD Foundation

[imp]

Ah! I complained that these were missing from a prior review, but they are just what I was hoping for.

[rpaulo]

sys/sys/cdefs.h

408

Can you explain why these are under a different feature? What happens when one feature is ON but the other is off?

426

This is probably not going to be enough because you may need to add __indexable to static inline functions in headers which are going to be used by both compilers.

[abhijeetsharma2002_gmail.com]

sys/sys/cdefs.h

408

bounds_safety_attributes enables the ABI-preserving annotations without applying the full bounds-safety pointer defaults, so unannotated parameters do not become __single. That provides an annotations-only migration mode where a file can be audited with -Wunsafe-buffer-usage before enabling full -fbounds-safety. The wide-pointer attributes are not supported in that mode, hence the bounds_attributes guard.

Separately, I noticed that my __has_ptrcheck definition is wrong, since I set it for either feature, whereas Clang's ptrcheck.h defines it only for bounds_attributes.

426

Makes sense. I will follow xnu and add a header_indexable/header_bidi_indexable pair that expands to nothing when unsupported.

[abhijeetsharma2002_gmail.com]

Fixed issues raised in review

[jrtc27]

sys/sys/cdefs.h

406

Does this serve a purpose? That is, why not just use has_feature(bounds_attributes) everywhere; is there another case where we'd want has_ptrcheck to be 1?