gc: change -u to require imports to be marked safe

R=ken2
CC=golang-dev
https://golang.org/cl/1597043

src/cmd/gc/export.c

@@ -268,7 +268,10 @@ dumpexport(void)
 	packagequotes = 1;
 	Bprint(bout, "\n$$  // exports\n");
 
-	Bprint(bout, "    package %s\n", localpkg->name);
+	Bprint(bout, "    package %s", localpkg->name);
+	if(safemode)
+		Bprint(bout, " safe");
+	Bprint(bout, "\n");
 
 	for(l=exportlist; l; l=l->next) {
 		lineno = l->n->lineno;

src/cmd/gc/go.h

@@ -578,6 +578,7 @@ struct	Io
 	int	peekc;
 	int	peekc1;	// second peekc for ...
 	char*	cp;	// used for content when bin==nil
+	int	importsafe;
 };
 
 typedef	struct	Dlist	Dlist;

src/cmd/gc/go.y

@@ -152,6 +152,7 @@ loadsys:
 			cannedimports("runtime.builtin", "package runtime\n\n$$\n\n");
 		else
 			cannedimports("runtime.builtin", runtimeimport);
+		curio.importsafe = 1;
 	}
 	import_package
 	import_there
@@ -236,11 +237,14 @@ import_here:
 	}
 
 import_package:
-	LPACKAGE sym ';'
+	LPACKAGE sym import_safety ';'
 	{
 		importpkg->name = $2->name;
 		importpkg->direct = 1;
 		
+		if(safemode && !curio.importsafe)
+			yyerror("cannot import unsafe package %Z", importpkg->path);
+
 		// NOTE(rsc): This is no longer a technical restriction:
 		// the 6g tool chain would work just fine without giving
 		// special meaning to a package being named main.
@@ -250,6 +254,13 @@ import_package:
 			yyerror("cannot import package main");
 	}
 
+import_safety:
+|	LNAME
+	{
+		if(strcmp($1->name, "safe") == 0)
+			curio.importsafe = 1;
+	}
+
 import_there:
 	{
 		defercheckwidth();

src/cmd/gc/lex.c

@@ -442,6 +442,7 @@ cannedimports(char *file, char *cp)
 	curio.infile = file;
 	curio.cp = cp;
 	curio.nlsemi = 0;
+	curio.importsafe = 0;
 
 	typecheckok = 1;
 	incannedimport = 1;

src/cmd/gc/typecheck.c

@@ -1191,7 +1191,10 @@ ret:
 			checkwidth(t);
 		}
 	}
-	if(safemode && isptrto(t, TANY))
+
+	// TODO(rsc): should not need to check importpkg,
+	// but reflect mentions unsafe.Pointer.
+	if(safemode && !incannedimport && !importpkg && isptrto(t, TANY))
 		yyerror("cannot use unsafe.Pointer");
 
 	evconst(n);