src/lxc/compiler.h

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #ifndef __LXC_COMPILER_H
   4 #define __LXC_COMPILER_H
   5
   6 #include "config.h"
   7
   8 #include <assert.h>
   9 #include <errno.h>
  10 #include <inttypes.h>
  11 #include <linux/types.h>
  12 #include <stdbool.h>
  13 #include <sys/param.h>
  14 #include <sys/sysmacros.h>
  15 #include <sys/types.h>
  16
  17 #ifndef thread_local
  18 #if __STDC_VERSION__ >= 201112L &&    \
  19     !(defined(__STDC_NO_THREADS__) || \
  20       (defined(__GNU_LIBRARY__) && __GLIBC__ == 2 && __GLIBC_MINOR__ < 16))
  21 #define thread_local _Thread_local
  22 #else
  23 #define thread_local __thread
  24 #endif
  25 #endif
  26
  27 #if HAVE_COMPILER_ATTR_FALLTHROUGH || __GNUC__ >= 7
  28 #define __fallthrough __attribute__((__fallthrough__))
  29 #else
  30 #define __fallthrough /* fall through */
  31 #endif
  32
  33 #if defined(__GNUC__) && !defined(__clang__)
  34         #if GCC_VERSION >= 50100
  35         #define COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW 1
  36         #endif
  37 #endif
  38
  39 #define likely(x) __builtin_expect(!!(x), 1)
  40 #define unlikely(x) __builtin_expect(!!(x), 0)
  41 #define __must_check __attribute__((__warn_unused_result__))
  42
  43 static inline bool __must_check __must_check_overflow(bool overflow)
  44 {
  45         return unlikely(overflow);
  46 }
  47
  48 #define is_signed_type(type)       (((type)(-1)) < (type)1)
  49 #define __type_half_max(type) ((type)1 << (8*sizeof(type) - 1 - is_signed_type(type)))
  50 #define type_max(T) ((T)((__type_half_max(T) - 1) + __type_half_max(T)))
  51 #define type_min(T) ((T)((T)-type_max(T)-(T)1))
  52
  53 /*
  54  * Avoids triggering -Wtype-limits compilation warning,
  55  * while using unsigned data types to check a < 0.
  56  */
  57 #define is_non_negative(a) ((a) > 0 || (a) == 0)
  58 #define is_negative(a) (!(is_non_negative(a)))
  59
  60 #ifdef COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW
  61 /*
  62  * For simplicity and code hygiene, the fallback code below insists on
  63  * a, b and *d having the same type (similar to the min() and max()
  64  * macros), whereas gcc's type-generic overflow checkers accept
  65  * different types. Hence we don't just make check_add_overflow an
  66  * alias for __builtin_add_overflow, but add type checks similar to
  67  * below.
  68  */
  69 #define check_add_overflow(a, b, d) __must_check_overflow(({    \
  70         typeof(a) __a = (a);                    \
  71         typeof(b) __b = (b);                    \
  72         typeof(d) __d = (d);                    \
  73         (void) (&__a == &__b);                  \
  74         (void) (&__a == __d);                   \
  75         __builtin_add_overflow(__a, __b, __d);  \
  76 }))
  77
  78 #define check_sub_overflow(a, b, d) __must_check_overflow(({    \
  79         typeof(a) __a = (a);                    \
  80         typeof(b) __b = (b);                    \
  81         typeof(d) __d = (d);                    \
  82         (void) (&__a == &__b);                  \
  83         (void) (&__a == __d);                   \
  84         __builtin_sub_overflow(__a, __b, __d);  \
  85 }))
  86
  87 #define check_mul_overflow(a, b, d) __must_check_overflow(({    \
  88         typeof(a) __a = (a);                    \
  89         typeof(b) __b = (b);                    \
  90         typeof(d) __d = (d);                    \
  91         (void) (&__a == &__b);                  \
  92         (void) (&__a == __d);                   \
  93         __builtin_mul_overflow(__a, __b, __d);  \
  94 }))
  95 #else /* !COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
  96
  97 /* Checking for unsigned overflow is relatively easy without causing UB. */
  98 #define __unsigned_add_overflow(a, b, d) ({     \
  99         typeof(a) __a = (a);                    \
 100         typeof(b) __b = (b);                    \
 101         typeof(d) __d = (d);                    \
 102         (void) (&__a == &__b);                  \
 103         (void) (&__a == __d);                   \
 104         *__d = __a + __b;                       \
 105         *__d < __a;                             \
 106 })
 107 #define __unsigned_sub_overflow(a, b, d) ({     \
 108         typeof(a) __a = (a);                    \
 109         typeof(b) __b = (b);                    \
 110         typeof(d) __d = (d);                    \
 111         (void) (&__a == &__b);                  \
 112         (void) (&__a == __d);                   \
 113         *__d = __a - __b;                       \
 114         __a < __b;                              \
 115 })
 116
 117 /*
 118  * If one of a or b is a compile-time constant, this avoids a division.
 119  */
 120 #define __unsigned_mul_overflow(a, b, d) ({             \
 121         typeof(a) __a = (a);                            \
 122         typeof(b) __b = (b);                            \
 123         typeof(d) __d = (d);                            \
 124         (void) (&__a == &__b);                          \
 125         (void) (&__a == __d);                           \
 126         *__d = __a * __b;                               \
 127         __builtin_constant_p(__b) ?                     \
 128           __b > 0 && __a > type_max(typeof(__a)) / __b : \
 129           __a > 0 && __b > type_max(typeof(__b)) / __a;  \
 130 })
 131
 132 /*
 133  * For signed types, detecting overflow is much harder, especially if
 134  * we want to avoid UB. But the interface of these macros is such that
 135  * we must provide a result in *d, and in fact we must produce the
 136  * result promised by gcc's builtins, which is simply the possibly
 137  * wrapped-around value. Fortunately, we can just formally do the
 138  * operations in the widest relevant unsigned type (u64) and then
 139  * truncate the result - gcc is smart enough to generate the same code
 140  * with and without the (u64) casts.
 141  */
 142
 143 /*
 144  * Adding two signed integers can overflow only if they have the same
 145  * sign, and overflow has happened iff the result has the opposite
 146  * sign.
 147  */
 148 #define __signed_add_overflow(a, b, d) ({       \
 149         typeof(a) __a = (a);                    \
 150         typeof(b) __b = (b);                    \
 151         typeof(d) __d = (d);                    \
 152         (void) (&__a == &__b);                  \
 153         (void) (&__a == __d);                   \
 154         *__d = (__u64)__a + (__u64)__b;         \
 155         (((~(__a ^ __b)) & (*__d ^ __a))        \
 156                 & type_min(typeof(__a))) != 0;  \
 157 })
 158
 159 /*
 160  * Subtraction is similar, except that overflow can now happen only
 161  * when the signs are opposite. In this case, overflow has happened if
 162  * the result has the opposite sign of a.
 163  */
 164 #define __signed_sub_overflow(a, b, d) ({       \
 165         typeof(a) __a = (a);                    \
 166         typeof(b) __b = (b);                    \
 167         typeof(d) __d = (d);                    \
 168         (void) (&__a == &__b);                  \
 169         (void) (&__a == __d);                   \
 170         *__d = (__u64)__a - (__u64)__b;         \
 171         ((((__a ^ __b)) & (*__d ^ __a))         \
 172                 & type_min(typeof(__a))) != 0;  \
 173 })
 174
 175 /*
 176  * Signed multiplication is rather hard. gcc always follows C99, so
 177  * division is truncated towards 0. This means that we can write the
 178  * overflow check like this:
 179  *
 180  * (a > 0 && (b > MAX/a || b < MIN/a)) ||
 181  * (a < -1 && (b > MIN/a || b < MAX/a) ||
 182  * (a == -1 && b == MIN)
 183  *
 184  * The redundant casts of -1 are to silence an annoying -Wtype-limits
 185  * (included in -Wextra) warning: When the type is u8 or u16, the
 186  * __b_c_e in check_mul_overflow obviously selects
 187  * __unsigned_mul_overflow, but unfortunately gcc still parses this
 188  * code and warns about the limited range of __b.
 189  */
 190
 191 #define __signed_mul_overflow(a, b, d) ({                               \
 192         typeof(a) __a = (a);                                            \
 193         typeof(b) __b = (b);                                            \
 194         typeof(d) __d = (d);                                            \
 195         typeof(a) __tmax = type_max(typeof(a));                         \
 196         typeof(a) __tmin = type_min(typeof(a));                         \
 197         (void) (&__a == &__b);                                          \
 198         (void) (&__a == __d);                                           \
 199         *__d = (__u64)__a * (__u64)__b;                                 \
 200         (__b > 0   && (__a > __tmax/__b || __a < __tmin/__b)) ||        \
 201         (__b < (typeof(__b))-1  && (__a > __tmin/__b || __a < __tmax/__b)) || \
 202         (__b == (typeof(__b))-1 && __a == __tmin);                      \
 203 })
 204
 205
 206 #define check_add_overflow(a, b, d)     __must_check_overflow(          \
 207         __builtin_choose_expr(is_signed_type(typeof(a)),                \
 208                         __signed_add_overflow(a, b, d),                 \
 209                         __unsigned_add_overflow(a, b, d)))
 210
 211 #define check_sub_overflow(a, b, d)     __must_check_overflow(          \
 212         __builtin_choose_expr(is_signed_type(typeof(a)),                \
 213                         __signed_sub_overflow(a, b, d),                 \
 214                         __unsigned_sub_overflow(a, b, d)))
 215
 216 #define check_mul_overflow(a, b, d)     __must_check_overflow(          \
 217         __builtin_choose_expr(is_signed_type(typeof(a)),                \
 218                         __signed_mul_overflow(a, b, d),                 \
 219                         __unsigned_mul_overflow(a, b, d)))
 220
 221 #endif /* COMPILER_HAS_GENERIC_BUILTIN_OVERFLOW */
 222
 223 #ifndef __noreturn
 224 #       if __STDC_VERSION__ >= 201112L
 225 #               if !IS_BIONIC
 226 #                       define __noreturn _Noreturn
 227 #               else
 228 #                       define __noreturn __attribute__((__noreturn__))
 229 #               endif
 230 #       elif IS_BIONIC
 231 #               define __noreturn __attribute__((__noreturn__))
 232 #       else
 233 #               define __noreturn __attribute__((noreturn))
 234 #       endif
 235 #endif
 236
 237 #ifndef __hot
 238 #       define __hot __attribute__((hot))
 239 #endif
 240
 241 #ifndef __returns_twice
 242 #define __returns_twice __attribute__((returns_twice))
 243 #endif
 244
 245 /* This attribute is required to silence clang warnings */
 246 #if defined(__GNUC__)
 247 #define __lxc_unused __attribute__ ((unused))
 248 #else
 249 #define __lxc_unused
 250 #endif
 251
 252 /* Indicates taking ownership */
 253 #define __owns
 254
 255 #define __cgfsng_ops
 256
 257 /* access attribute */
 258 #define __access_r_nosize(x)
 259 #define __access_r(x, y)
 260 #define __access_w(x, y)
 261 #define __access_rw(x, y)
 262
 263 #ifdef __has_attribute
 264 #if __has_attribute(access)
 265 #undef __access_r
 266 #define __access_r(x, y) __attribute__((access(read_only, x, y)))
 267
 268 #undef __access_r_nosize
 269 #define __access_r_nosize(x) __attribute__((access(read_only, x)))
 270
 271 #undef __access_w
 272 #define __access_w(x, y) __attribute__((access(write_only, x, y)))
 273
 274 #undef __access_rw
 275 #define __access_rw(x, y) __attribute__((access(read_write, x, y)))
 276 #endif
 277 #endif
 278
 279 #ifndef __hidden
 280 #define __hidden __attribute__((visibility("hidden")))
 281 #endif
 282
 283 #ifndef __public
 284 #define __public __attribute__((visibility("default")))
 285 #endif
 286
 287 /* Are two types/vars the same type (ignoring qualifiers)? */
 288 #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
 289
 290 #define __compiletime_assert(condition, msg, prefix, suffix) \
 291         do {                                                 \
 292         } while (0)
 293
 294 #define _compiletime_assert(condition, msg, prefix, suffix) \
 295         __compiletime_assert(condition, msg, prefix, suffix)
 296
 297 /**
 298  * compiletime_assert - break build and emit msg if condition is false
 299  * @condition: a compile-time constant condition to check
 300  * @msg:       a message to emit if condition is false
 301  *
 302  * In tradition of POSIX assert, this macro will break the build if the
 303  * supplied condition is *false*, emitting the supplied error message if the
 304  * compiler has support to do so.
 305  */
 306 #define compiletime_assert(condition, msg) \
 307         _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
 308
 309 /**
 310  * BUILD_BUG_ON_MSG - break compile if a condition is true & emit supplied
 311  *                    error message.
 312  * @condition: the condition which the compiler should know is false.
 313  *
 314  * See BUILD_BUG_ON for description.
 315  */
 316 #define BUILD_BUG_ON_MSG(cond, msg) compiletime_assert(!(cond), msg)
 317
 318 #endif /* __LXC_COMPILER_H */