1 | /* |
2 | * Copyright (c) 2000-2018 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright 1995 NeXT Computer, Inc. All rights reserved. */ |
29 | /* |
30 | * Copyright (c) 1991, 1993 |
31 | * The Regents of the University of California. All rights reserved. |
32 | * |
33 | * This code is derived from software contributed to Berkeley by |
34 | * Berkeley Software Design, Inc. |
35 | * |
36 | * Redistribution and use in source and binary forms, with or without |
37 | * modification, are permitted provided that the following conditions |
38 | * are met: |
39 | * 1. Redistributions of source code must retain the above copyright |
40 | * notice, this list of conditions and the following disclaimer. |
41 | * 2. Redistributions in binary form must reproduce the above copyright |
42 | * notice, this list of conditions and the following disclaimer in the |
43 | * documentation and/or other materials provided with the distribution. |
44 | * 3. All advertising materials mentioning features or use of this software |
45 | * must display the following acknowledgement: |
46 | * This product includes software developed by the University of |
47 | * California, Berkeley and its contributors. |
48 | * 4. Neither the name of the University nor the names of its contributors |
49 | * may be used to endorse or promote products derived from this software |
50 | * without specific prior written permission. |
51 | * |
52 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
53 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
54 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
55 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
56 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
57 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
58 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
59 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
60 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
61 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
62 | * SUCH DAMAGE. |
63 | * |
64 | * @(#)cdefs.h 8.8 (Berkeley) 1/9/95 |
65 | */ |
66 | |
67 | #ifndef _CDEFS_H_ |
68 | #define _CDEFS_H_ |
69 | |
70 | #if defined(__cplusplus) |
71 | #define __BEGIN_DECLS extern "C" { |
72 | #define __END_DECLS } |
73 | #else |
74 | #define __BEGIN_DECLS |
75 | #define __END_DECLS |
76 | #endif |
77 | |
78 | /* This SDK is designed to work with clang and specific versions of |
79 | * gcc >= 4.0 with Apple's patch sets */ |
80 | #if !defined(__GNUC__) || __GNUC__ < 4 |
81 | #warning "Unsupported compiler detected" |
82 | #endif |
83 | |
84 | /* |
85 | * Compatibility with compilers and environments that don't support compiler |
86 | * feature checking function-like macros. |
87 | */ |
88 | #ifndef __has_builtin |
89 | #define __has_builtin(x) 0 |
90 | #endif |
91 | #ifndef __has_include |
92 | #define __has_include(x) 0 |
93 | #endif |
94 | #ifndef __has_feature |
95 | #define __has_feature(x) 0 |
96 | #endif |
97 | #ifndef __has_attribute |
98 | #define __has_attribute(x) 0 |
99 | #endif |
100 | #ifndef __has_cpp_attribute |
101 | #define __has_cpp_attribute(x) 0 |
102 | #endif |
103 | #ifndef __has_extension |
104 | #define __has_extension(x) 0 |
105 | #endif |
106 | |
107 | /* |
108 | * The __CONCAT macro is used to concatenate parts of symbol names, e.g. |
109 | * with "#define OLD(foo) __CONCAT(old,foo)", OLD(foo) produces oldfoo. |
110 | * The __CONCAT macro is a bit tricky -- make sure you don't put spaces |
111 | * in between its arguments. __CONCAT can also concatenate double-quoted |
112 | * strings produced by the __STRING macro, but this only works with ANSI C. |
113 | */ |
114 | #if defined(__STDC__) || defined(__cplusplus) |
115 | #define __P(protos) protos /* full-blown ANSI C */ |
116 | #define __CONCAT(x, y) x ## y |
117 | #define __STRING(x) #x |
118 | |
119 | #define __const const /* define reserved names to standard */ |
120 | #define __signed signed |
121 | #define __volatile volatile |
122 | #if defined(__cplusplus) |
123 | #define __inline inline /* convert to C++ keyword */ |
124 | #else |
125 | #ifndef __GNUC__ |
126 | #define __inline /* delete GCC keyword */ |
127 | #endif /* !__GNUC__ */ |
128 | #endif /* !__cplusplus */ |
129 | |
130 | #else /* !(__STDC__ || __cplusplus) */ |
131 | #define __P(protos) () /* traditional C preprocessor */ |
132 | #define __CONCAT(x, y) x /**/ y |
133 | #define __STRING(x) "x" |
134 | |
135 | #ifndef __GNUC__ |
136 | #define __const /* delete pseudo-ANSI C keywords */ |
137 | #define __inline |
138 | #define __signed |
139 | #define __volatile |
140 | #endif /* !__GNUC__ */ |
141 | |
142 | /* |
143 | * In non-ANSI C environments, new programs will want ANSI-only C keywords |
144 | * deleted from the program and old programs will want them left alone. |
145 | * When using a compiler other than gcc, programs using the ANSI C keywords |
146 | * const, inline etc. as normal identifiers should define -DNO_ANSI_KEYWORDS. |
147 | * When using "gcc -traditional", we assume that this is the intent; if |
148 | * __GNUC__ is defined but __STDC__ is not, we leave the new keywords alone. |
149 | */ |
150 | #ifndef NO_ANSI_KEYWORDS |
151 | #define const __const /* convert ANSI C keywords */ |
152 | #define inline __inline |
153 | #define signed __signed |
154 | #define volatile __volatile |
155 | #endif /* !NO_ANSI_KEYWORDS */ |
156 | #endif /* !(__STDC__ || __cplusplus) */ |
157 | |
158 | /* |
159 | * __pure2 can be used for functions that are only a function of their scalar |
160 | * arguments (meaning they can't dereference pointers). |
161 | * |
162 | * __stateful_pure can be used for functions that have no side effects, |
163 | * but depend on the state of the memory. |
164 | */ |
165 | #define __dead2 __attribute__((__noreturn__)) |
166 | #define __pure2 __attribute__((__const__)) |
167 | #define __stateful_pure __attribute__((__pure__)) |
168 | |
169 | /* __unused denotes variables and functions that may not be used, preventing |
170 | * the compiler from warning about it if not used. |
171 | */ |
172 | #define __unused __attribute__((__unused__)) |
173 | |
174 | /* __used forces variables and functions to be included even if it appears |
175 | * to the compiler that they are not used (and would thust be discarded). |
176 | */ |
177 | #define __used __attribute__((__used__)) |
178 | |
179 | /* __cold marks code used for debugging or that is rarely taken |
180 | * and tells the compiler to optimize for size and outline code. |
181 | */ |
182 | #if __has_attribute(cold) |
183 | #define __cold __attribute__((__cold__)) |
184 | #else |
185 | #define __cold |
186 | #endif |
187 | |
188 | /* __returns_nonnull marks functions that return a non-null pointer. */ |
189 | #if __has_attribute(returns_nonnull) |
190 | #define __returns_nonnull __attribute((returns_nonnull)) |
191 | #else |
192 | #define __returns_nonnull |
193 | #endif |
194 | |
195 | /* __exported denotes symbols that should be exported even when symbols |
196 | * are hidden by default. |
197 | * __exported_push/_exported_pop are pragmas used to delimit a range of |
198 | * symbols that should be exported even when symbols are hidden by default. |
199 | */ |
200 | #define __exported __attribute__((__visibility__("default"))) |
201 | #define __exported_push _Pragma("GCC visibility push(default)") |
202 | #define __exported_pop _Pragma("GCC visibility pop") |
203 | |
204 | /* __deprecated causes the compiler to produce a warning when encountering |
205 | * code using the deprecated functionality. |
206 | * __deprecated_msg() does the same, and compilers that support it will print |
207 | * a message along with the deprecation warning. |
208 | * This may require turning on such warning with the -Wdeprecated flag. |
209 | * __deprecated_enum_msg() should be used on enums, and compilers that support |
210 | * it will print the deprecation warning. |
211 | * __kpi_deprecated() specifically indicates deprecation of kernel programming |
212 | * interfaces in Kernel.framework used by KEXTs. |
213 | */ |
214 | #define __deprecated __attribute__((__deprecated__)) |
215 | |
216 | #if __has_extension(attribute_deprecated_with_message) || \ |
217 | (defined(__GNUC__) && ((__GNUC__ >= 5) || ((__GNUC__ == 4) && (__GNUC_MINOR__ >= 5)))) |
218 | #define __deprecated_msg(_msg) __attribute__((__deprecated__(_msg))) |
219 | #else |
220 | #define __deprecated_msg(_msg) __attribute__((__deprecated__)) |
221 | #endif |
222 | |
223 | #if __has_extension(enumerator_attributes) |
224 | #define __deprecated_enum_msg(_msg) __deprecated_msg(_msg) |
225 | #else |
226 | #define __deprecated_enum_msg(_msg) |
227 | #endif |
228 | |
229 | #if defined(KERNEL) && !defined(KERNEL_PRIVATE) |
230 | #define __kpi_deprecated(_msg) __deprecated_msg(_msg) |
231 | #else /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ |
232 | #define __kpi_deprecated(_msg) |
233 | #endif /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ |
234 | |
235 | /* __unavailable causes the compiler to error out when encountering |
236 | * code using the tagged function |
237 | */ |
238 | #if __has_attribute(unavailable) |
239 | #define __unavailable __attribute__((__unavailable__)) |
240 | #else |
241 | #define __unavailable |
242 | #endif |
243 | |
244 | #if defined(KERNEL) && !defined(KERNEL_PRIVATE) |
245 | #define __kpi_unavailable __unavailable |
246 | #else /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ |
247 | #define __kpi_unavailable |
248 | #endif /* !defined(KERNEL) || defined(KERNEL_PRIVATE) */ |
249 | |
250 | #if XNU_KERNEL_PRIVATE |
251 | /* This macro is meant to be used for kpi deprecated to x86 3rd parties |
252 | * but should be marked as unavailable for arm macOS devices. |
253 | * XNU: nothing (API is still available) |
254 | * 1st party kexts: __deprecated |
255 | * 3rd party kexts macOS x86: __deprecated |
256 | * 3rd party kexts macOS arm: __unavailable |
257 | */ |
258 | #define __kpi_deprecated_arm64_macos_unavailable |
259 | #elif !KERNEL || !XNU_PLATFORM_MacOSX |
260 | #define __kpi_deprecated_arm64_macos_unavailable |
261 | #elif KERNEL_PRIVATE |
262 | #define __kpi_deprecated_arm64_macos_unavailable __deprecated |
263 | #elif defined(__arm64__) |
264 | #define __kpi_deprecated_arm64_macos_unavailable __unavailable |
265 | #else |
266 | #define __kpi_deprecated_arm64_macos_unavailable __deprecated |
267 | #endif /* XNU_KERNEL_PRIVATE */ |
268 | |
269 | /* Delete pseudo-keywords wherever they are not available or needed. */ |
270 | #ifndef __dead |
271 | #define __dead |
272 | #define __pure |
273 | #endif |
274 | |
275 | /* |
276 | * We use `__restrict' as a way to define the `restrict' type qualifier |
277 | * without disturbing older software that is unaware of C99 keywords. |
278 | */ |
279 | #if __STDC_VERSION__ < 199901 |
280 | #define __restrict |
281 | #else |
282 | #define __restrict restrict |
283 | #endif |
284 | |
285 | /* Compatibility with compilers and environments that don't support the |
286 | * nullability feature. |
287 | */ |
288 | |
289 | #if !__has_feature(nullability) |
290 | #ifndef __nullable |
291 | #define __nullable |
292 | #endif |
293 | #ifndef __nonnull |
294 | #define __nonnull |
295 | #endif |
296 | #ifndef __null_unspecified |
297 | #define __null_unspecified |
298 | #endif |
299 | #ifndef _Nullable |
300 | #define _Nullable |
301 | #endif |
302 | #ifndef _Nonnull |
303 | #define _Nonnull |
304 | #endif |
305 | #ifndef _Null_unspecified |
306 | #define _Null_unspecified |
307 | #endif |
308 | #endif |
309 | |
310 | /* |
311 | * __disable_tail_calls causes the compiler to not perform tail call |
312 | * optimization inside the marked function. |
313 | */ |
314 | #if __has_attribute(disable_tail_calls) |
315 | #define __disable_tail_calls __attribute__((__disable_tail_calls__)) |
316 | #else |
317 | #define __disable_tail_calls |
318 | #endif |
319 | |
320 | /* |
321 | * __not_tail_called causes the compiler to prevent tail call optimization |
322 | * on statically bound calls to the function. It has no effect on indirect |
323 | * calls. Virtual functions, objective-c methods, and functions marked as |
324 | * "always_inline" cannot be marked as __not_tail_called. |
325 | */ |
326 | #if __has_attribute(not_tail_called) |
327 | #define __not_tail_called __attribute__((__not_tail_called__)) |
328 | #else |
329 | #define __not_tail_called |
330 | #endif |
331 | |
332 | /* |
333 | * __result_use_check warns callers of a function that not using the function |
334 | * return value is a bug, i.e. dismissing malloc() return value results in a |
335 | * memory leak. |
336 | */ |
337 | #if __has_attribute(warn_unused_result) |
338 | #define __result_use_check __attribute__((__warn_unused_result__)) |
339 | #else |
340 | #define __result_use_check |
341 | #endif |
342 | |
343 | /* |
344 | * __swift_unavailable causes the compiler to mark a symbol as specifically |
345 | * unavailable in Swift, regardless of any other availability in C. |
346 | */ |
347 | #if __has_feature(attribute_availability_swift) |
348 | #define __swift_unavailable(_msg) __attribute__((__availability__(swift, unavailable, message=_msg))) |
349 | #else |
350 | #define __swift_unavailable(_msg) |
351 | #endif |
352 | |
353 | /* |
354 | * __abortlike is the attribute to put on functions like abort() that are |
355 | * typically used to mark assertions. These optimize the codegen |
356 | * for outlining while still maintaining debugability. |
357 | */ |
358 | #ifndef __abortlike |
359 | #define __abortlike __dead2 __cold __not_tail_called |
360 | #endif |
361 | |
362 | /* Declaring inline functions within headers is error-prone due to differences |
363 | * across various versions of the C language and extensions. __header_inline |
364 | * can be used to declare inline functions within system headers. In cases |
365 | * where you want to force inlining instead of letting the compiler make |
366 | * the decision, you can use __header_always_inline. |
367 | * |
368 | * Be aware that using inline for functions which compilers may also provide |
369 | * builtins can behave differently under various compilers. If you intend to |
370 | * provide an inline version of such a function, you may want to use a macro |
371 | * instead. |
372 | * |
373 | * The check for !__GNUC__ || __clang__ is because gcc doesn't correctly |
374 | * support c99 inline in some cases: |
375 | * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=55965 |
376 | */ |
377 | |
378 | #if defined(__cplusplus) || \ |
379 | (__STDC_VERSION__ >= 199901L && \ |
380 | !defined(__GNUC_GNU_INLINE__) && \ |
381 | (!defined(__GNUC__) || defined(__clang__))) |
382 | # define inline |
383 | #elif defined(__GNUC__) && defined(__GNUC_STDC_INLINE__) |
384 | # define __header_inline extern __inline __attribute__((__gnu_inline__)) |
385 | #elif defined(__GNUC__) |
386 | # define __header_inline extern __inline |
387 | #else |
388 | /* If we land here, we've encountered an unsupported compiler, |
389 | * so hopefully it understands static __inline as a fallback. |
390 | */ |
391 | # define __header_inline static __inline |
392 | #endif |
393 | |
394 | #ifdef __GNUC__ |
395 | # define __header_inline __attribute__ ((__always_inline__)) |
396 | #else |
397 | /* Unfortunately, we're using a compiler that we don't know how to force to |
398 | * inline. Oh well. |
399 | */ |
400 | # define __header_always_inline __header_inline |
401 | #endif |
402 | |
403 | /* |
404 | * Compiler-dependent macros that bracket portions of code where the |
405 | * "-Wunreachable-code" warning should be ignored. Please use sparingly. |
406 | */ |
407 | #if defined(__clang__) |
408 | # define __unreachable_ok_push \ |
409 | _Pragma("clang diagnostic push") \ |
410 | _Pragma("clang diagnostic ignored \"-Wunreachable-code\"") |
411 | # define __unreachable_ok_pop \ |
412 | _Pragma("clang diagnostic pop") |
413 | #elif defined(__GNUC__) && ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 6)) |
414 | # define __unreachable_ok_push \ |
415 | _Pragma("GCC diagnostic push") \ |
416 | _Pragma("GCC diagnostic ignored \"-Wunreachable-code\"") |
417 | # define __unreachable_ok_pop \ |
418 | _Pragma("GCC diagnostic pop") |
419 | #else |
420 | # define __unreachable_ok_push |
421 | # define __unreachable_ok_pop |
422 | #endif |
423 | |
424 | /* |
425 | * Compiler-dependent macros to declare that functions take printf-like |
426 | * or scanf-like arguments. They are null except for versions of gcc |
427 | * that are known to support the features properly. Functions declared |
428 | * with these attributes will cause compilation warnings if there is a |
429 | * mismatch between the format string and subsequent function parameter |
430 | * types. |
431 | */ |
432 | #define __printflike(fmtarg, firstvararg) \ |
433 | __attribute__((__format__ (__printf__, fmtarg, firstvararg))) |
434 | #define __printf0like(fmtarg, firstvararg) \ |
435 | __attribute__((__format__ (__printf0__, fmtarg, firstvararg))) |
436 | #define __scanflike(fmtarg, firstvararg) \ |
437 | __attribute__((__format__ (__scanf__, fmtarg, firstvararg))) |
438 | #define __osloglike(fmtarg, firstvararg) \ |
439 | __attribute__((__format__ (__os_log__, fmtarg, firstvararg))) |
440 | |
441 | #define __IDSTRING(name, string) static const char name[] __used = string |
442 | |
443 | #ifndef __COPYRIGHT |
444 | #define __COPYRIGHT(s) __IDSTRING(copyright,s) |
445 | #endif |
446 | |
447 | #ifndef __RCSID |
448 | #define __RCSID(s) __IDSTRING(rcsid,s) |
449 | #endif |
450 | |
451 | #ifndef __SCCSID |
452 | #define __SCCSID(s) __IDSTRING(sccsid,s) |
453 | #endif |
454 | |
455 | #ifndef __PROJECT_VERSION |
456 | #define __PROJECT_VERSION(s) __IDSTRING(project_version,s) |
457 | #endif |
458 | |
459 | /* Source compatibility only, ID string not emitted in object file */ |
460 | #ifndef __FBSDID |
461 | #define __FBSDID(s) |
462 | #endif |
463 | |
464 | #ifndef __DECONST |
465 | #define __DECONST(type, var) __CAST_AWAY_QUALIFIER(var, const, type) |
466 | #endif |
467 | |
468 | #ifndef __DEVOLATILE |
469 | #define __DEVOLATILE(type, var) __CAST_AWAY_QUALIFIER(var, volatile, type) |
470 | #endif |
471 | |
472 | #ifndef __DEQUALIFY |
473 | #define __DEQUALIFY(type, var) __CAST_AWAY_QUALIFIER(var, const volatile, type) |
474 | #endif |
475 | |
476 | /* |
477 | * __alloc_align can be used to label function arguments that represent the |
478 | * alignment of the returned pointer. |
479 | */ |
480 | #ifndef __alloc_align |
481 | #if __has_attribute(alloc_align) |
482 | #define __alloc_align(n) __attribute__((alloc_align(n))) |
483 | #else |
484 | #define __alloc_align(n) |
485 | #endif |
486 | #endif // __alloc_align |
487 | |
488 | /* |
489 | * __alloc_size can be used to label function arguments that represent the |
490 | * size of memory that the function allocates and returns. The one-argument |
491 | * form labels a single argument that gives the allocation size (where the |
492 | * arguments are numbered from 1): |
493 | * |
494 | * void *malloc(size_t __size) __alloc_size(1); |
495 | * |
496 | * The two-argument form handles the case where the size is calculated as the |
497 | * product of two arguments: |
498 | * |
499 | * void *calloc(size_t __count, size_t __size) __alloc_size(1,2); |
500 | */ |
501 | #ifndef __alloc_size |
502 | #if __has_attribute(alloc_size) |
503 | #define __alloc_size(...) __attribute__((alloc_size(__VA_ARGS__))) |
504 | #else |
505 | #define __alloc_size(...) |
506 | #endif |
507 | #endif // __alloc_size |
508 | |
509 | /* |
510 | * Facilities below assist adoption of -Wunsafe-buffer-usage, an off-by-default |
511 | * Clang compiler warning that helps the developer minimize unsafe, raw |
512 | * buffer manipulation in the code that may lead to buffer overflow |
513 | * vulnerabilities. |
514 | * |
515 | * They are primarily designed for modern C++ code where -Wunsafe-buffer-usage |
516 | * comes with automatic fix-it hints that help the developer transform |
517 | * their code to use modern C++ containers, which may be made bounds-safe by |
518 | * linking against a version of the C++ standard library that offers |
519 | * bounds-checked containers. |
520 | * They can be used in plain C, but -fbounds-safety is the preferred solution |
521 | * for plain C (see also <ptrcheck.h>). |
522 | * |
523 | * Attribute __unsafe_buffer_usage can be used to label functions that should be |
524 | * avoided as they may perform or otherwise introduce unsafe buffer |
525 | * manipulation operations. |
526 | * |
527 | * Calls to such functions are flagged by -Wunsafe-buffer-usage, similarly to |
528 | * how unchecked buffer manipulation operations are flagged when observed |
529 | * by the compiler directly: |
530 | * |
531 | * // An unsafe function that needs to be avoided. |
532 | * __unsafe_buffer_usage |
533 | * void foo(int *buf, size_t size); |
534 | * |
535 | * // A safe alternative to foo(). |
536 | * void foo(std::span<int> buf); |
537 | * |
538 | * void bar(size_t idx) { |
539 | * int array[5]; |
540 | * |
541 | * // Direct unsafe buffer manipulation through subscript operator: |
542 | * array[idx] = 3; // warning [-Wunsafe-buffer-usage] |
543 | * // Unsafe buffer manipulation through function foo(): |
544 | * foo(array, 5); // warning [-Wunsafe-buffer-usage] |
545 | * // Checked buffer manipulation, with bounds information automatically |
546 | * // preserved for the purposes of runtime checks in standard library: |
547 | * foo(array); // no warning |
548 | * } |
549 | * |
550 | * While annotating a function as __unsafe_buffer_usage has an effect similar |
551 | * to annotating it as __deprecated, the __unsafe_buffer_usage attribute |
552 | * should be used whenever the resulting warning needs to be controlled |
553 | * by the -Wunsafe-buffer-usage flag (which is turned off in codebases that |
554 | * don't attempt to achieve bounds safety this way) as opposed to -Wdeprecated |
555 | * (enabled in most codebases). |
556 | * |
557 | * The attribute does NOT suppress -Wunsafe-buffer-usage warnings inside |
558 | * the function's body; it simply introduces new warnings at each call site |
559 | * to help the developers avoid the function entirely. Most of the time |
560 | * it does not make sense to annotate a function as __unsafe_buffer_usage |
561 | * without providing the users with a safe alternative. |
562 | * |
563 | * Pragmas __unsafe_buffer_usage_begin and __unsafe_buffer_usage_end |
564 | * annotate a range of code as intentionally containing unsafe buffer |
565 | * operations. They suppress -Wunsafe-buffer-usage warnings |
566 | * for unsafe operations in range: |
567 | * |
568 | * __unsafe_buffer_usage_begin |
569 | * array[idx] = 3; // warning suppressed |
570 | * foo(array, 5); // warning suppressed |
571 | * __unsafe_buffer_usage_end |
572 | * |
573 | * These pragmas are NOT a way to mass-annotate functions with the attribute |
574 | * __unsafe_buffer_usage. Functions declared within the pragma range |
575 | * do NOT get annotated automatically. In some rare situations it makes sense |
576 | * to do all three: put the attribute on the function, put pragmas inside |
577 | * the body of the function, and put pragmas around some call sites. |
578 | */ |
579 | #if __has_cpp_attribute(clang::unsafe_buffer_usage) |
580 | #define __has_safe_buffers 1 |
581 | #define __unsafe_buffer_usage [[clang::unsafe_buffer_usage]] |
582 | #elif __has_attribute(unsafe_buffer_usage) |
583 | #define __has_safe_buffers 1 |
584 | #define __unsafe_buffer_usage __attribute__((__unsafe_buffer_usage__)) |
585 | #else |
586 | #define __has_safe_buffers 0 |
587 | #define __unsafe_buffer_usage |
588 | #endif |
589 | #if __has_safe_buffers |
590 | #define __unsafe_buffer_usage_begin _Pragma("clang unsafe_buffer_usage begin") |
591 | #define __unsafe_buffer_usage_end _Pragma("clang unsafe_buffer_usage end") |
592 | #else |
593 | #define __unsafe_buffer_usage_begin |
594 | #define __unsafe_buffer_usage_end |
595 | #endif |
596 | |
597 | /* |
598 | * COMPILATION ENVIRONMENTS -- see compat(5) for additional detail |
599 | * |
600 | * DEFAULT By default newly complied code will get POSIX APIs plus |
601 | * Apple API extensions in scope. |
602 | * |
603 | * Most users will use this compilation environment to avoid |
604 | * behavioral differences between 32 and 64 bit code. |
605 | * |
606 | * LEGACY Defining _NONSTD_SOURCE will get pre-POSIX APIs plus Apple |
607 | * API extensions in scope. |
608 | * |
609 | * This is generally equivalent to the Tiger release compilation |
610 | * environment, except that it cannot be applied to 64 bit code; |
611 | * its use is discouraged. |
612 | * |
613 | * We expect this environment to be deprecated in the future. |
614 | * |
615 | * STRICT Defining _POSIX_C_SOURCE or _XOPEN_SOURCE restricts the |
616 | * available APIs to exactly the set of APIs defined by the |
617 | * corresponding standard, based on the value defined. |
618 | * |
619 | * A correct, portable definition for _POSIX_C_SOURCE is 200112L. |
620 | * A correct, portable definition for _XOPEN_SOURCE is 600L. |
621 | * |
622 | * Apple API extensions are not visible in this environment, |
623 | * which can cause Apple specific code to fail to compile, |
624 | * or behave incorrectly if prototypes are not in scope or |
625 | * warnings about missing prototypes are not enabled or ignored. |
626 | * |
627 | * In any compilation environment, for correct symbol resolution to occur, |
628 | * function prototypes must be in scope. It is recommended that all Apple |
629 | * tools users add either the "-Wall" or "-Wimplicit-function-declaration" |
630 | * compiler flags to their projects to be warned when a function is being |
631 | * used without a prototype in scope. |
632 | */ |
633 | |
634 | /* These settings are particular to each product. */ |
635 | #ifdef KERNEL |
636 | #define __DARWIN_ONLY_64_BIT_INO_T 0 |
637 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 0 |
638 | #define __DARWIN_ONLY_VERS_1050 0 |
639 | #if defined(__x86_64__) |
640 | #define __DARWIN_SUF_DARWIN14 "_darwin14" |
641 | #define __DARWIN14_ALIAS(sym) __asm("_" __STRING(sym) __DARWIN_SUF_DARWIN14) |
642 | #else |
643 | #define __DARWIN14_ALIAS(sym) |
644 | #endif |
645 | #else /* !KERNEL */ |
646 | #ifdef XNU_PLATFORM_iPhoneOS |
647 | /* Platform: iPhoneOS */ |
648 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
649 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
650 | #define __DARWIN_ONLY_VERS_1050 1 |
651 | #endif /* XNU_PLATFORM_iPhoneOS */ |
652 | #ifdef XNU_PLATFORM_iPhoneSimulator |
653 | /* Platform: iPhoneSimulator */ |
654 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
655 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
656 | #define __DARWIN_ONLY_VERS_1050 1 |
657 | #endif /* XNU_PLATFORM_iPhoneSimulator */ |
658 | #ifdef XNU_PLATFORM_tvOS |
659 | /* Platform: tvOS */ |
660 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
661 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
662 | #define __DARWIN_ONLY_VERS_1050 1 |
663 | #endif /* XNU_PLATFORM_tvOS */ |
664 | #ifdef XNU_PLATFORM_AppleTVOS |
665 | /* Platform: AppleTVOS */ |
666 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
667 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
668 | #define __DARWIN_ONLY_VERS_1050 1 |
669 | #endif /* XNU_PLATFORM_AppleTVOS */ |
670 | #ifdef XNU_PLATFORM_tvSimulator |
671 | /* Platform: tvSimulator */ |
672 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
673 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
674 | #define __DARWIN_ONLY_VERS_1050 1 |
675 | #endif /* XNU_PLATFORM_tvSimulator */ |
676 | #ifdef XNU_PLATFORM_AppleTVSimulator |
677 | /* Platform: AppleTVSimulator */ |
678 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
679 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
680 | #define __DARWIN_ONLY_VERS_1050 1 |
681 | #endif /* XNU_PLATFORM_AppleTVSimulator */ |
682 | #ifdef XNU_PLATFORM_iPhoneOSNano |
683 | /* Platform: iPhoneOSNano */ |
684 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
685 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
686 | #define __DARWIN_ONLY_VERS_1050 1 |
687 | #endif /* XNU_PLATFORM_iPhoneOSNano */ |
688 | #ifdef XNU_PLATFORM_iPhoneNanoSimulator |
689 | /* Platform: iPhoneNanoSimulator */ |
690 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
691 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
692 | #define __DARWIN_ONLY_VERS_1050 1 |
693 | #endif /* XNU_PLATFORM_iPhoneNanoSimulator */ |
694 | #ifdef XNU_PLATFORM_WatchOS |
695 | /* Platform: WatchOS */ |
696 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
697 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
698 | #define __DARWIN_ONLY_VERS_1050 1 |
699 | #endif /* XNU_PLATFORM_WatchOS */ |
700 | #ifdef XNU_PLATFORM_WatchSimulator |
701 | /* Platform: WatchSimulator */ |
702 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
703 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
704 | #define __DARWIN_ONLY_VERS_1050 1 |
705 | #endif /* XNU_PLATFORM_WatchSimulator */ |
706 | #ifdef XNU_PLATFORM_BridgeOS |
707 | /* Platform: BridgeOS */ |
708 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
709 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
710 | #define __DARWIN_ONLY_VERS_1050 1 |
711 | #endif /* XNU_PLATFORM_BridgeOS */ |
712 | #ifdef XNU_PLATFORM_DriverKit |
713 | /* Platform: DriverKit */ |
714 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
715 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
716 | #define __DARWIN_ONLY_VERS_1050 1 |
717 | #endif /* XNU_PLATFORM_DriverKit */ |
718 | #ifdef XNU_PLATFORM_MacOSX |
719 | /* Platform: MacOSX */ |
720 | #if defined(__i386__) |
721 | #define __DARWIN_ONLY_64_BIT_INO_T 0 |
722 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 0 |
723 | #define __DARWIN_ONLY_VERS_1050 0 |
724 | #elif defined(__x86_64__) |
725 | #define __DARWIN_ONLY_64_BIT_INO_T 0 |
726 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
727 | #define __DARWIN_ONLY_VERS_1050 0 |
728 | #else |
729 | #define __DARWIN_ONLY_64_BIT_INO_T 1 |
730 | #define __DARWIN_ONLY_UNIX_CONFORMANCE 1 |
731 | #define __DARWIN_ONLY_VERS_1050 1 |
732 | #endif |
733 | #endif /* XNU_PLATFORM_MacOSX */ |
734 | #endif /* KERNEL */ |
735 | |
736 | /* |
737 | * The __DARWIN_ALIAS macros are used to do symbol renaming; they allow |
738 | * legacy code to use the old symbol, thus maintaining binary compatibility |
739 | * while new code can use a standards compliant version of the same function. |
740 | * |
741 | * __DARWIN_ALIAS is used by itself if the function signature has not |
742 | * changed, it is used along with a #ifdef check for __DARWIN_UNIX03 |
743 | * if the signature has changed. Because the __LP64__ environment |
744 | * only supports UNIX03 semantics it causes __DARWIN_UNIX03 to be |
745 | * defined, but causes __DARWIN_ALIAS to do no symbol mangling. |
746 | * |
747 | * As a special case, when XCode is used to target a specific version of the |
748 | * OS, the manifest constant __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ |
749 | * will be defined by the compiler, with the digits representing major version |
750 | * time 100 + minor version times 10 (e.g. 10.5 := 1050). If we are targeting |
751 | * pre-10.5, and it is the default compilation environment, revert the |
752 | * compilation environment to pre-__DARWIN_UNIX03. |
753 | */ |
754 | #if !defined(__DARWIN_UNIX03) |
755 | # if defined(KERNEL) |
756 | # define __DARWIN_UNIX03 0 |
757 | # elif __DARWIN_ONLY_UNIX_CONFORMANCE |
758 | # if defined(_NONSTD_SOURCE) |
759 | # error "Can't define _NONSTD_SOURCE when only UNIX conformance is available." |
760 | # endif /* _NONSTD_SOURCE */ |
761 | # define __DARWIN_UNIX03 1 |
762 | # elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1040) |
763 | # define __DARWIN_UNIX03 0 |
764 | # elif defined(_DARWIN_C_SOURCE) || defined(_XOPEN_SOURCE) || defined(_POSIX_C_SOURCE) |
765 | # if defined(_NONSTD_SOURCE) |
766 | # error "Can't define both _NONSTD_SOURCE and any of _DARWIN_C_SOURCE, _XOPEN_SOURCE or _POSIX_C_SOURCE." |
767 | # endif /* _NONSTD_SOURCE */ |
768 | # define __DARWIN_UNIX03 1 |
769 | # elif defined(_NONSTD_SOURCE) |
770 | # define __DARWIN_UNIX03 0 |
771 | # else /* default */ |
772 | # if defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1050) |
773 | # define __DARWIN_UNIX03 0 |
774 | # else /* __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ >= 1050 */ |
775 | # define __DARWIN_UNIX03 1 |
776 | # endif /* __ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ >= 1050 */ |
777 | # endif /* _DARWIN_C_SOURCE || _XOPEN_SOURCE || _POSIX_C_SOURCE || __LP64__ */ |
778 | #endif /* !__DARWIN_UNIX03 */ |
779 | |
780 | #if !defined(__DARWIN_64_BIT_INO_T) |
781 | # if defined(KERNEL) |
782 | # define __DARWIN_64_BIT_INO_T 0 |
783 | # elif defined(_DARWIN_USE_64_BIT_INODE) |
784 | # if defined(_DARWIN_NO_64_BIT_INODE) |
785 | # error "Can't define both _DARWIN_USE_64_BIT_INODE and _DARWIN_NO_64_BIT_INODE." |
786 | # endif /* _DARWIN_NO_64_BIT_INODE */ |
787 | # define __DARWIN_64_BIT_INO_T 1 |
788 | # elif defined(_DARWIN_NO_64_BIT_INODE) |
789 | # if __DARWIN_ONLY_64_BIT_INO_T |
790 | # error "Can't define _DARWIN_NO_64_BIT_INODE when only 64-bit inodes are available." |
791 | # endif /* __DARWIN_ONLY_64_BIT_INO_T */ |
792 | # define __DARWIN_64_BIT_INO_T 0 |
793 | # else /* default */ |
794 | # if __DARWIN_ONLY_64_BIT_INO_T |
795 | # define __DARWIN_64_BIT_INO_T 1 |
796 | # elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1060) || __DARWIN_UNIX03 == 0 |
797 | # define __DARWIN_64_BIT_INO_T 0 |
798 | # else /* default */ |
799 | # define __DARWIN_64_BIT_INO_T 1 |
800 | # endif /* __DARWIN_ONLY_64_BIT_INO_T */ |
801 | # endif |
802 | #endif /* !__DARWIN_64_BIT_INO_T */ |
803 | |
804 | #if !defined(__DARWIN_VERS_1050) |
805 | # if defined(KERNEL) |
806 | # define __DARWIN_VERS_1050 0 |
807 | # elif __DARWIN_ONLY_VERS_1050 |
808 | # define __DARWIN_VERS_1050 1 |
809 | # elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) && ((__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__ - 0) < 1050) || __DARWIN_UNIX03 == 0 |
810 | # define __DARWIN_VERS_1050 0 |
811 | # else /* default */ |
812 | # define __DARWIN_VERS_1050 1 |
813 | # endif |
814 | #endif /* !__DARWIN_VERS_1050 */ |
815 | |
816 | #if !defined(__DARWIN_NON_CANCELABLE) |
817 | # if defined(KERNEL) |
818 | # define __DARWIN_NON_CANCELABLE 0 |
819 | # else /* default */ |
820 | # define __DARWIN_NON_CANCELABLE 0 |
821 | # endif |
822 | #endif /* !__DARWIN_NON_CANCELABLE */ |
823 | |
824 | /* |
825 | * symbol suffixes used for symbol versioning |
826 | */ |
827 | #if __DARWIN_UNIX03 |
828 | # if __DARWIN_ONLY_UNIX_CONFORMANCE |
829 | # define __DARWIN_SUF_UNIX03 /* nothing */ |
830 | # else /* !__DARWIN_ONLY_UNIX_CONFORMANCE */ |
831 | # define __DARWIN_SUF_UNIX03 "$UNIX2003" |
832 | # endif /* __DARWIN_ONLY_UNIX_CONFORMANCE */ |
833 | |
834 | # if __DARWIN_64_BIT_INO_T |
835 | # if __DARWIN_ONLY_64_BIT_INO_T |
836 | # define __DARWIN_SUF_64_BIT_INO_T /* nothing */ |
837 | # else /* !__DARWIN_ONLY_64_BIT_INO_T */ |
838 | # define __DARWIN_SUF_64_BIT_INO_T "$INODE64" |
839 | # endif /* __DARWIN_ONLY_64_BIT_INO_T */ |
840 | # else /* !__DARWIN_64_BIT_INO_T */ |
841 | # define __DARWIN_SUF_64_BIT_INO_T /* nothing */ |
842 | # endif /* __DARWIN_64_BIT_INO_T */ |
843 | |
844 | # if __DARWIN_VERS_1050 |
845 | # if __DARWIN_ONLY_VERS_1050 |
846 | # define __DARWIN_SUF_1050 /* nothing */ |
847 | # else /* !__DARWIN_ONLY_VERS_1050 */ |
848 | # define __DARWIN_SUF_1050 "$1050" |
849 | # endif /* __DARWIN_ONLY_VERS_1050 */ |
850 | # else /* !__DARWIN_VERS_1050 */ |
851 | # define __DARWIN_SUF_1050 /* nothing */ |
852 | # endif /* __DARWIN_VERS_1050 */ |
853 | |
854 | # if __DARWIN_NON_CANCELABLE |
855 | # define __DARWIN_SUF_NON_CANCELABLE "$NOCANCEL" |
856 | # else /* !__DARWIN_NON_CANCELABLE */ |
857 | # define __DARWIN_SUF_NON_CANCELABLE /* nothing */ |
858 | # endif /* __DARWIN_NON_CANCELABLE */ |
859 | |
860 | #else /* !__DARWIN_UNIX03 */ |
861 | # define __DARWIN_SUF_UNIX03 /* nothing */ |
862 | # define __DARWIN_SUF_64_BIT_INO_T /* nothing */ |
863 | # define __DARWIN_SUF_NON_CANCELABLE /* nothing */ |
864 | # define __DARWIN_SUF_1050 /* nothing */ |
865 | #endif /* __DARWIN_UNIX03 */ |
866 | |
867 | #define __DARWIN_SUF_EXTSN "$DARWIN_EXTSN" |
868 | |
869 | /* |
870 | * symbol versioning macros |
871 | */ |
872 | #define __DARWIN_ALIAS(sym) __asm("_" __STRING(sym) __DARWIN_SUF_UNIX03) |
873 | #define __DARWIN_ALIAS_C(sym) __asm("_" __STRING(sym) __DARWIN_SUF_NON_CANCELABLE __DARWIN_SUF_UNIX03) |
874 | #define __DARWIN_ALIAS_I(sym) __asm("_" __STRING(sym) __DARWIN_SUF_64_BIT_INO_T __DARWIN_SUF_UNIX03) |
875 | #define __DARWIN_NOCANCEL(sym) __asm("_" __STRING(sym) __DARWIN_SUF_NON_CANCELABLE) |
876 | #define __DARWIN_INODE64(sym) __asm("_" __STRING(sym) __DARWIN_SUF_64_BIT_INO_T) |
877 | |
878 | #define __DARWIN_1050(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050) |
879 | #define __DARWIN_1050ALIAS(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_UNIX03) |
880 | #define __DARWIN_1050ALIAS_C(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_NON_CANCELABLE __DARWIN_SUF_UNIX03) |
881 | #define __DARWIN_1050ALIAS_I(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_64_BIT_INO_T __DARWIN_SUF_UNIX03) |
882 | #define __DARWIN_1050INODE64(sym) __asm("_" __STRING(sym) __DARWIN_SUF_1050 __DARWIN_SUF_64_BIT_INO_T) |
883 | |
884 | #define __DARWIN_EXTSN(sym) __asm("_" __STRING(sym) __DARWIN_SUF_EXTSN) |
885 | #define __DARWIN_EXTSN_C(sym) __asm("_" __STRING(sym) __DARWIN_SUF_EXTSN __DARWIN_SUF_NON_CANCELABLE) |
886 | #if XNU_KERNEL_PRIVATE |
887 | #define __XNU_INTERNAL(sym) __asm("_" __STRING(sym) "$XNU_INTERNAL") __attribute__((used)) |
888 | #endif |
889 | |
890 | /* |
891 | * symbol release macros |
892 | */ |
893 | #ifdef KERNEL |
894 | #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) |
895 | #else |
896 | #include <sys/_symbol_aliasing.h> |
897 | |
898 | #if defined(__ENVIRONMENT_IPHONE_OS_VERSION_MIN_REQUIRED__) |
899 | #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) __DARWIN_ALIAS_STARTING_IPHONE_##_iphone(x) |
900 | #elif defined(__ENVIRONMENT_MAC_OS_X_VERSION_MIN_REQUIRED__) |
901 | #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) __DARWIN_ALIAS_STARTING_MAC_##_mac(x) |
902 | #else |
903 | #define __DARWIN_ALIAS_STARTING(_mac, _iphone, x) x |
904 | #endif |
905 | #endif /* KERNEL */ |
906 | |
907 | |
908 | /* |
909 | * POSIX.1 requires that the macros we test be defined before any standard |
910 | * header file is included. This permits us to convert values for feature |
911 | * testing, as necessary, using only _POSIX_C_SOURCE. |
912 | * |
913 | * Here's a quick run-down of the versions: |
914 | * defined(_POSIX_SOURCE) 1003.1-1988 |
915 | * _POSIX_C_SOURCE == 1L 1003.1-1990 |
916 | * _POSIX_C_SOURCE == 2L 1003.2-1992 C Language Binding Option |
917 | * _POSIX_C_SOURCE == 199309L 1003.1b-1993 |
918 | * _POSIX_C_SOURCE == 199506L 1003.1c-1995, 1003.1i-1995, |
919 | * and the omnibus ISO/IEC 9945-1: 1996 |
920 | * _POSIX_C_SOURCE == 200112L 1003.1-2001 |
921 | * _POSIX_C_SOURCE == 200809L 1003.1-2008 |
922 | * |
923 | * In addition, the X/Open Portability Guide, which is now the Single UNIX |
924 | * Specification, defines a feature-test macro which indicates the version of |
925 | * that specification, and which subsumes _POSIX_C_SOURCE. |
926 | */ |
927 | |
928 | /* Deal with IEEE Std. 1003.1-1990, in which _POSIX_C_SOURCE == 1L. */ |
929 | #if defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE == 1L |
930 | #undef _POSIX_C_SOURCE |
931 | #define _POSIX_C_SOURCE 199009L |
932 | #endif |
933 | |
934 | /* Deal with IEEE Std. 1003.2-1992, in which _POSIX_C_SOURCE == 2L. */ |
935 | #if defined(_POSIX_C_SOURCE) && _POSIX_C_SOURCE == 2L |
936 | #undef _POSIX_C_SOURCE |
937 | #define _POSIX_C_SOURCE 199209L |
938 | #endif |
939 | |
940 | /* Deal with various X/Open Portability Guides and Single UNIX Spec. */ |
941 | #ifdef _XOPEN_SOURCE |
942 | #if _XOPEN_SOURCE - 0L >= 700L && (!defined(_POSIX_C_SOURCE) || _POSIX_C_SOURCE - 0L < 200809L) |
943 | #undef _POSIX_C_SOURCE |
944 | #define _POSIX_C_SOURCE 200809L |
945 | #elif _XOPEN_SOURCE - 0L >= 600L && (!defined(_POSIX_C_SOURCE) || _POSIX_C_SOURCE - 0L < 200112L) |
946 | #undef _POSIX_C_SOURCE |
947 | #define _POSIX_C_SOURCE 200112L |
948 | #elif _XOPEN_SOURCE - 0L >= 500L && (!defined(_POSIX_C_SOURCE) || _POSIX_C_SOURCE - 0L < 199506L) |
949 | #undef _POSIX_C_SOURCE |
950 | #define _POSIX_C_SOURCE 199506L |
951 | #endif |
952 | #endif |
953 | |
954 | /* |
955 | * Deal with all versions of POSIX. The ordering relative to the tests above is |
956 | * important. |
957 | */ |
958 | #if defined(_POSIX_SOURCE) && !defined(_POSIX_C_SOURCE) |
959 | #define _POSIX_C_SOURCE 198808L |
960 | #endif |
961 | |
962 | /* POSIX C deprecation macros */ |
963 | #ifdef KERNEL |
964 | #define __POSIX_C_DEPRECATED(ver) |
965 | #else |
966 | #include <sys/_posix_availability.h> |
967 | |
968 | #define __POSIX_C_DEPRECATED(ver) ___POSIX_C_DEPRECATED_STARTING_##ver |
969 | #endif |
970 | |
971 | /* |
972 | * Set a single macro which will always be defined and can be used to determine |
973 | * the appropriate namespace. For POSIX, these values will correspond to |
974 | * _POSIX_C_SOURCE value. Currently there are two additional levels corresponding |
975 | * to ANSI (_ANSI_SOURCE) and Darwin extensions (_DARWIN_C_SOURCE) |
976 | */ |
977 | #define __DARWIN_C_ANSI 010000L |
978 | #define __DARWIN_C_FULL 900000L |
979 | |
980 | #if defined(_ANSI_SOURCE) |
981 | #define __DARWIN_C_LEVEL __DARWIN_C_ANSI |
982 | #elif defined(_POSIX_C_SOURCE) && !defined(_DARWIN_C_SOURCE) && !defined(_NONSTD_SOURCE) |
983 | #define __DARWIN_C_LEVEL _POSIX_C_SOURCE |
984 | #else |
985 | #define __DARWIN_C_LEVEL __DARWIN_C_FULL |
986 | #endif |
987 | |
988 | /* If the developer has neither requested a strict language mode nor a version |
989 | * of POSIX, turn on functionality provided by __STDC_WANT_LIB_EXT1__ as part |
990 | * of __DARWIN_C_FULL. |
991 | */ |
992 | #if !defined(__STDC_WANT_LIB_EXT1__) && !defined(__STRICT_ANSI__) && __DARWIN_C_LEVEL >= __DARWIN_C_FULL |
993 | #define __STDC_WANT_LIB_EXT1__ 1 |
994 | #endif |
995 | |
996 | /* |
997 | * long long is not supported in c89 (__STRICT_ANSI__), but g++ -ansi and |
998 | * c99 still want long longs. While not perfect, we allow long longs for |
999 | * g++. |
1000 | */ |
1001 | #if (defined(__STRICT_ANSI__) && (__STDC_VERSION__ - 0 < 199901L) && !defined(__GNUG__)) |
1002 | #define __DARWIN_NO_LONG_LONG 1 |
1003 | #else |
1004 | #define __DARWIN_NO_LONG_LONG 0 |
1005 | #endif |
1006 | |
1007 | /***************************************** |
1008 | * Public darwin-specific feature macros |
1009 | *****************************************/ |
1010 | |
1011 | /* |
1012 | * _DARWIN_FEATURE_64_BIT_INODE indicates that the ino_t type is 64-bit, and |
1013 | * structures modified for 64-bit inodes (like struct stat) will be used. |
1014 | */ |
1015 | #if __DARWIN_64_BIT_INO_T |
1016 | #define _DARWIN_FEATURE_64_BIT_INODE 1 |
1017 | #endif |
1018 | |
1019 | /* |
1020 | * _DARWIN_FEATURE_64_ONLY_BIT_INODE indicates that the ino_t type may only |
1021 | * be 64-bit; there is no support for 32-bit ino_t when this macro is defined |
1022 | * (and non-zero). There is no struct stat64 either, as the regular |
1023 | * struct stat will already be the 64-bit version. |
1024 | */ |
1025 | #if __DARWIN_ONLY_64_BIT_INO_T |
1026 | #define _DARWIN_FEATURE_ONLY_64_BIT_INODE 1 |
1027 | #endif |
1028 | |
1029 | /* |
1030 | * _DARWIN_FEATURE_ONLY_VERS_1050 indicates that only those APIs updated |
1031 | * in 10.5 exists; no pre-10.5 variants are available. |
1032 | */ |
1033 | #if __DARWIN_ONLY_VERS_1050 |
1034 | #define _DARWIN_FEATURE_ONLY_VERS_1050 1 |
1035 | #endif |
1036 | |
1037 | /* |
1038 | * _DARWIN_FEATURE_ONLY_UNIX_CONFORMANCE indicates only UNIX conforming API |
1039 | * are available (the legacy BSD APIs are not available) |
1040 | */ |
1041 | #if __DARWIN_ONLY_UNIX_CONFORMANCE |
1042 | #define _DARWIN_FEATURE_ONLY_UNIX_CONFORMANCE 1 |
1043 | #endif |
1044 | |
1045 | /* |
1046 | * _DARWIN_FEATURE_UNIX_CONFORMANCE indicates whether UNIX conformance is on, |
1047 | * and specifies the conformance level (3 is SUSv3) |
1048 | */ |
1049 | #if __DARWIN_UNIX03 |
1050 | #define _DARWIN_FEATURE_UNIX_CONFORMANCE 3 |
1051 | #endif |
1052 | |
1053 | #if defined(DRIVERKIT) && !defined(KERNEL) |
1054 | /* |
1055 | * __DRIVERKIT_LIBC__ indicates to the C++ standard library headers and |
1056 | * similar components that only the restricted set of standard C library |
1057 | * functionality and headers for the DriverKit userspace driver environment |
1058 | * are available. |
1059 | */ |
1060 | #define __DRIVERKIT_LIBC__ 1 |
1061 | #endif /* defined(DRIVERKIT) && !defined(KERNEL) */ |
1062 | |
1063 | /* |
1064 | * This macro casts away the qualifier from the variable |
1065 | * |
1066 | * Note: use at your own risk, removing qualifiers can result in |
1067 | * catastrophic run-time failures. |
1068 | */ |
1069 | #ifndef __CAST_AWAY_QUALIFIER |
1070 | /* |
1071 | * XXX: this shouldn't ignore anything more than -Wcast-qual, |
1072 | * but the old implementation made it an almighty cast that |
1073 | * ignored everything, so things break left and right if you |
1074 | * make it only ignore -Wcast-qual. |
1075 | */ |
1076 | #define __CAST_AWAY_QUALIFIER(variable, qualifier, type) \ |
1077 | _Pragma("GCC diagnostic push") \ |
1078 | _Pragma("GCC diagnostic ignored \"-Wcast-qual\"") \ |
1079 | _Pragma("GCC diagnostic ignored \"-Wcast-align\"") \ |
1080 | _Pragma("GCC diagnostic ignored \"-Waddress-of-packed-member\"") \ |
1081 | ((type)(variable)) \ |
1082 | _Pragma("GCC diagnostic pop") |
1083 | #endif |
1084 | |
1085 | /* |
1086 | * __XNU_PRIVATE_EXTERN is a linkage decoration indicating that a symbol can be |
1087 | * used from other compilation units, but not other libraries or executables. |
1088 | */ |
1089 | #ifndef __XNU_PRIVATE_EXTERN |
1090 | #define __XNU_PRIVATE_EXTERN __attribute__((visibility("hidden"))) |
1091 | #endif |
1092 | |
1093 | #if __has_include(<ptrcheck.h>) |
1094 | #include <ptrcheck.h> |
1095 | #else |
1096 | /* |
1097 | * We intentionally define to nothing pointer attributes which do not have an |
1098 | * impact on the ABI. __indexable and __bidi_indexable are not defined because |
1099 | * of the ABI incompatibility that makes the diagnostic preferable. |
1100 | */ |
1101 | #define __has_ptrcheck 0 |
1102 | #define __single |
1103 | #define __unsafe_indexable |
1104 | #define __counted_by(N) |
1105 | #define __sized_by(N) |
1106 | #define __ended_by(E) |
1107 | #define __terminated_by(T) |
1108 | #define __null_terminated |
1109 | |
1110 | /* |
1111 | * Similarly, we intentionally define to nothing the |
1112 | * __ptrcheck_abi_assume_single and __ptrcheck_abi_assume_unsafe_indexable |
1113 | * macros because they do not lead to an ABI incompatibility. However, we do not |
1114 | * define the indexable and unsafe_indexable ones because the diagnostic is |
1115 | * better than the silent ABI break. |
1116 | */ |
1117 | #define __ptrcheck_abi_assume_single() |
1118 | #define __ptrcheck_abi_assume_unsafe_indexable() |
1119 | |
1120 | /* __unsafe_forge intrinsics are defined as regular C casts. */ |
1121 | #define __unsafe_forge_bidi_indexable(T, P, S) ((T)(P)) |
1122 | #define __unsafe_forge_single(T, P) ((T)(P)) |
1123 | #define __unsafe_forge_terminated_by(T, P, E) ((T)(P)) |
1124 | #define __unsafe_forge_null_terminated(T, P) ((T)(P)) |
1125 | #define __terminated_by_to_indexable(P) (P) |
1126 | #define __unsafe_terminated_by_to_indexable(P) (P) |
1127 | #define __null_terminated_to_indexable(P) (P) |
1128 | #define __unsafe_null_terminated_to_indexable(P) (P) |
1129 | #define __unsafe_terminated_by_from_indexable(T, P, ...) (P) |
1130 | #define __unsafe_null_terminated_from_indexable(P, ...) (P) |
1131 | |
1132 | /* decay operates normally; attribute is meaningless without pointer checks. */ |
1133 | #define __array_decay_dicards_count_in_parameters |
1134 | |
1135 | /* this is a write-once variable; not useful without pointer checks. */ |
1136 | #define __unsafe_late_const |
1137 | |
1138 | #define __ptrcheck_unavailable |
1139 | #define __ptrcheck_unavailable_r(REPLACEMENT) |
1140 | |
1141 | #endif /* !__has_include(<ptrcheck.h>) */ |
1142 | |
1143 | #if KERNEL && !BOUND_CHECKS && !__has_ptrcheck |
1144 | /* |
1145 | * With pointer checks disabled, we define __indexable to allow source to still |
1146 | * contain these annotations. This is safe in builds which _uniformly_ disable |
1147 | * pointer checks (but not in builds which inconsistently have them enabled). |
1148 | */ |
1149 | |
1150 | #define __indexable |
1151 | #define __bidi_indexable |
1152 | #endif |
1153 | |
1154 | #define __ASSUME_PTR_ABI_SINGLE_BEGIN __ptrcheck_abi_assume_single() |
1155 | #define __ASSUME_PTR_ABI_SINGLE_END __ptrcheck_abi_assume_unsafe_indexable() |
1156 | |
1157 | #if __has_ptrcheck |
1158 | #define __header_indexable __indexable |
1159 | #define __header_bidi_indexable __bidi_indexable |
1160 | #else |
1161 | #define |
1162 | #define |
1163 | #endif |
1164 | |
1165 | /* |
1166 | * Architecture validation for current SDK |
1167 | */ |
1168 | #if !defined(__sys_cdefs_arch_unknown__) && defined(__i386__) |
1169 | #elif !defined(__sys_cdefs_arch_unknown__) && defined(__x86_64__) |
1170 | #elif !defined(__sys_cdefs_arch_unknown__) && defined(__arm__) |
1171 | #elif !defined(__sys_cdefs_arch_unknown__) && defined(__arm64__) |
1172 | #else |
1173 | #error Unsupported architecture |
1174 | #endif |
1175 | |
1176 | #ifdef XNU_KERNEL_PRIVATE |
1177 | /* |
1178 | * Selectively ignore cast alignment warnings |
1179 | */ |
1180 | #define __IGNORE_WCASTALIGN(x) _Pragma("clang diagnostic push") \ |
1181 | _Pragma("clang diagnostic ignored \"-Wcast-align\"") \ |
1182 | x \ |
1183 | _Pragma("clang diagnostic pop") |
1184 | #endif |
1185 | |
1186 | #if defined(PRIVATE) || defined(KERNEL) |
1187 | /* |
1188 | * Check if __probable and __improbable have already been defined elsewhere. |
1189 | * These macros inform the compiler (and humans) about which branches are likely |
1190 | * to be taken. |
1191 | */ |
1192 | #if !defined(__probable) && !defined(__improbable) |
1193 | #define __probable(x) __builtin_expect(!!(x), 1) |
1194 | #define __improbable(x) __builtin_expect(!!(x), 0) |
1195 | #endif /* !defined(__probable) && !defined(__improbable) */ |
1196 | |
1197 | #define __container_of(ptr, type_t, field) __extension__({ \ |
1198 | const __typeof__(((type_t *)NULL)->field) *__ptr = (ptr); \ |
1199 | uintptr_t __result = (uintptr_t)__ptr - offsetof(type_t, field); \ |
1200 | if (__ptr) __builtin_assume(__result != 0); \ |
1201 | __unsafe_forge_single(type_t *, __result); \ |
1202 | }) |
1203 | |
1204 | #define __container_of_safe(ptr, type_t, field) __extension__({ \ |
1205 | const __typeof__(((type_t *)NULL)->field) *__ptr_or_null = (ptr); \ |
1206 | __ptr_or_null ? __container_of(__ptr_or_null, type_t, field) : NULL; \ |
1207 | }) |
1208 | |
1209 | /* |
1210 | * This forces the optimizer to materialize the specified variable value, |
1211 | * and prevents any reordering of operations done to it. |
1212 | */ |
1213 | #define __compiler_materialize_and_prevent_reordering_on(var) \ |
1214 | __asm__ ("" : "=r"(var) : "0"(var)) |
1215 | |
1216 | #endif /* KERNEL || PRIVATE */ |
1217 | |
1218 | #define __compiler_barrier() __asm__ __volatile__("" ::: "memory") |
1219 | |
1220 | #if __has_attribute(enum_extensibility) |
1221 | #define __enum_open __attribute__((__enum_extensibility__(open))) |
1222 | #define __enum_closed __attribute__((__enum_extensibility__(closed))) |
1223 | #else |
1224 | #define __enum_open |
1225 | #define __enum_closed |
1226 | #endif // __has_attribute(enum_extensibility) |
1227 | |
1228 | #if __has_attribute(flag_enum) |
1229 | #define __enum_options __attribute__((__flag_enum__)) |
1230 | #else |
1231 | #define __enum_options |
1232 | #endif |
1233 | |
1234 | /* |
1235 | * Similar to OS_ENUM/OS_CLOSED_ENUM/OS_OPTIONS/OS_CLOSED_OPTIONS |
1236 | * |
1237 | * This provides more advanced type checking on compilers supporting |
1238 | * the proper extensions, even in C. |
1239 | */ |
1240 | #if __has_feature(objc_fixed_enum) || __has_extension(cxx_fixed_enum) || \ |
1241 | __has_extension(cxx_strong_enums) |
1242 | #define __enum_decl(_name, _type, ...) \ |
1243 | typedef enum : _type __VA_ARGS__ __enum_open _name |
1244 | #define __enum_closed_decl(_name, _type, ...) \ |
1245 | typedef enum : _type __VA_ARGS__ __enum_closed _name |
1246 | #define __options_decl(_name, _type, ...) \ |
1247 | typedef enum : _type __VA_ARGS__ __enum_open __enum_options _name |
1248 | #define __options_closed_decl(_name, _type, ...) \ |
1249 | typedef enum : _type __VA_ARGS__ __enum_closed __enum_options _name |
1250 | #else |
1251 | #define __enum_decl(_name, _type, ...) \ |
1252 | typedef _type _name; enum __VA_ARGS__ __enum_open |
1253 | #define __enum_closed_decl(_name, _type, ...) \ |
1254 | typedef _type _name; enum __VA_ARGS__ __enum_closed |
1255 | #define __options_decl(_name, _type, ...) \ |
1256 | typedef _type _name; enum __VA_ARGS__ __enum_open __enum_options |
1257 | #define __options_closed_decl(_name, _type, ...) \ |
1258 | typedef _type _name; enum __VA_ARGS__ __enum_closed __enum_options |
1259 | #endif |
1260 | |
1261 | #if XNU_KERNEL_PRIVATE |
1262 | /* |
1263 | * __xnu_struct_group() can be used to declare a set of fields to be grouped |
1264 | * together logically in order to perform safer memory operations |
1265 | * (assignment, zeroing, ...) on them. |
1266 | */ |
1267 | #ifdef __cplusplus |
1268 | #define __xnu_struct_group(group_type, group_name, ...) \ |
1269 | struct group_type __VA_ARGS__; \ |
1270 | union { \ |
1271 | struct __VA_ARGS__; \ |
1272 | struct group_type group_name; \ |
1273 | } |
1274 | #else |
1275 | #define __xnu_struct_group(group_type, group_name, ...) \ |
1276 | union { \ |
1277 | struct __VA_ARGS__; \ |
1278 | struct group_type __VA_ARGS__ group_name; \ |
1279 | } |
1280 | #endif |
1281 | #endif /* XNU_KERNEL_PRIVATE */ |
1282 | |
1283 | #if defined(KERNEL) && __has_attribute(xnu_usage_semantics) |
1284 | /* |
1285 | * These macros can be used to annotate type definitions or scalar structure |
1286 | * fields to inform the compiler about which semantic they have with regards |
1287 | * to the content of the underlying memory represented by such type or field. |
1288 | * |
1289 | * This information is used in the analysis of the types performed by the |
1290 | * signature based type segregation implemented in kalloc. |
1291 | */ |
1292 | #define __kernel_ptr_semantics __attribute__((xnu_usage_semantics("pointer"))) |
1293 | #define __kernel_data_semantics __attribute__((xnu_usage_semantics("data"))) |
1294 | #define __kernel_dual_semantics __attribute__((xnu_usage_semantics("pointer", "data"))) |
1295 | |
1296 | #else /* defined(KERNEL) && __has_attribute(xnu_usage_semantics) */ |
1297 | |
1298 | #define __kernel_ptr_semantics |
1299 | #define __kernel_data_semantics |
1300 | #define __kernel_dual_semantics |
1301 | |
1302 | #endif /* defined(KERNEL) && __has_attribute(xnu_usage_semantics) */ |
1303 | |
1304 | #if XNU_KERNEL_PRIVATE |
1305 | /* |
1306 | * Compiler-dependent macros that bracket portions of code where the |
1307 | * "-Wxnu-typed-allocators" warning should be ignored. |
1308 | */ |
1309 | #if defined(__clang__) |
1310 | # define __typed_allocators_ignore_push \ |
1311 | _Pragma("clang diagnostic push") \ |
1312 | _Pragma("clang diagnostic ignored \"-Wxnu-typed-allocators\"") |
1313 | # define __typed_allocators_ignore_pop \ |
1314 | _Pragma("clang diagnostic pop") |
1315 | # define __typed_allocators_ignore(x) __typed_allocators_ignore_push \ |
1316 | x \ |
1317 | __typed_allocators_ignore_pop |
1318 | #else |
1319 | # define __typed_allocators_ignore_push |
1320 | # define __typed_allocators_ignore_push |
1321 | # define __typed_allocators_ignore(x) x |
1322 | #endif /* __clang */ |
1323 | #endif /* XNU_KERNEL_PRIVATE */ |
1324 | |
1325 | #endif /* !_CDEFS_H_ */ |
1326 | |