cdefs: add bounds-safety annotation macros
AcceptedPublic
Actions

Authored by abhijeetsharma2002_gmail.com on Wed, Aug 19, 11:52 AM.

Details

Reviewers

rpaulo
emaste
imp

Summary

Define the -fbounds-safety vocabulary (counted_by, sized_by,
__single, the forge escape hatches). Every macro expands to nothing
under compilers without the extension, so the annotated tree builds
unchanged with the stock toolchain.

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Skipped

Unit

Tests Skipped

Build Status

Buildable 76328
Build 73211: arc lint + arc unit

Event Timeline

abhijeetsharma2002_gmail.com created this revision.Wed, Aug 19, 11:52 AM

Herald added a subscriber: imp. · View Herald TranscriptWed, Aug 19, 11:52 AM

abhijeetsharma2002_gmail.com requested review of this revision.Wed, Aug 19, 11:52 AM

Harbormaster completed remote builds in B75736: Diff 184350.Wed, Aug 19, 11:52 AM

abhijeetsharma2002_gmail.com added a parent revision: D58943: tools/build: stage stdckdint.h's dependencies for non-FreeBSD hosts.Wed, Aug 19, 11:57 AM

abhijeetsharma2002_gmail.com added a child revision: D58984: kern.mk: add per-file bounds-safety build knob.Wed, Aug 19, 12:01 PM

Ah! I complained that these were missing from a prior review, but they are just what I was hoping for.

This revision is now accepted and ready to land.Wed, Aug 19, 7:24 PM

rpaulo added inline comments.Thu, Aug 27, 10:24 PM

sys/sys/cdefs.h
408	Can you explain why these are under a different feature? What happens when one feature is ON but the other is off?
426	This is probably not going to be enough because you may need to add __indexable to static inline functions in headers which are going to be used by both compilers.

abhijeetsharma2002_gmail.com added inline comments.Sat, Aug 29, 11:09 PM

sys/sys/cdefs.h
408	bounds_safety_attributes enables the ABI-preserving annotations without applying the full bounds-safety pointer defaults, so unannotated parameters do not become __single. That provides an annotations-only migration mode where a file can be audited with -Wunsafe-buffer-usage before enabling full -fbounds-safety. The wide-pointer attributes are not supported in that mode, hence the bounds_attributes guard. Separately, I noticed that my __has_ptrcheck definition is wrong, since I set it for either feature, whereas Clang's ptrcheck.h defines it only for bounds_attributes.
426	Makes sense. I will follow xnu and add a header_indexable/header_bidi_indexable pair that expands to nothing when unsupported.