[PATCH v2] docs: Explain the desired position of function attributes

[PATCH v2] docs: Explain the desired position of function attributes

[Kees Cook]

While discussing how to format the addition of various function
attributes, some "unwritten rules" of ordering surfaced[1]. Capture as
close as possible to Linus's preferences for future reference.

(Though I note the dissent voiced by Joe Perches, Alexey Dobriyan, and
others that would prefer all attributes live on a separate leading line.)

[1] https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 Documentation/process/coding-style.rst | 30 ++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
index 42969ab37b34..6b4feb1c71e7 100644
--- a/Documentation/process/coding-style.rst
+++ b/Documentation/process/coding-style.rst
@@ -487,6 +487,36 @@ because it is a simple way to add valuable information for the reader.
 Do not use the ``extern`` keyword with function prototypes as this makes
 lines longer and isn't strictly necessary.
 
+When writing a function declarations, please keep the `order of elements regular
+<https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/>`_.
+For example::
+
+ extern __init void * __must_check void action(enum magic value, size_t size,
+ 	u8 count, char *fmt, ...) __printf(4, 5) __malloc;
+
+The preferred order of elements for a function prototype is:
+
+- storage class (here, ``extern``, and things like ``static __always_inline`` even though
+  ``__always_inline`` is technically an attribute, it is treated like ``inline``)
+- storage class attributes (here, ``__init`` -- i.e. section declarations, but also things like ``__cold``)
+- return type (here, ``void *``)
+- return type attributes (here, ``__must_check``)
+- function name (here, ``action``)
+- function parameters (here, ``(enum magic value, size_t size, u8 count, char *fmt, ...)``, noting that parameter names should always be included)
+- function parameter attributes (here, ``__printf(4, 5)``)
+- function behavior attributes (here, ``__malloc``)
+
+Note that for a function definition (e.g. ``static inline``), the compiler does
+not allow function parameter attributes after the function parameters. In these
+cases, they should go after the storage class attributes (e.g. note the changed
+position of ``__printf(4, 5)``)::
+
+ static __always_inline __init __printf(4, 5) void * __must_check void action(
+ 		enum magic value, size_t size, u8 count, char *fmt, ...)
+ 		__malloc
+ {
+ 	...
+ }
 
 7) Centralized exiting of functions
 -----------------------------------
-- 
2.30.2

Re: [PATCH v2] docs: Explain the desired position of function attributes

[Randy Dunlap]

On 9/30/21 12:24 PM, Kees Cook wrote:
> While discussing how to format the addition of various function
> attributes, some "unwritten rules" of ordering surfaced[1]. Capture as
> close as possible to Linus's preferences for future reference.
> 
> (Though I note the dissent voiced by Joe Perches, Alexey Dobriyan, and
> others that would prefer all attributes live on a separate leading line.)
> 
> [1] https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
>   Documentation/process/coding-style.rst | 30 ++++++++++++++++++++++++++
>   1 file changed, 30 insertions(+)
> 
> diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
> index 42969ab37b34..6b4feb1c71e7 100644
> --- a/Documentation/process/coding-style.rst
> +++ b/Documentation/process/coding-style.rst
> @@ -487,6 +487,36 @@ because it is a simple way to add valuable information for the reader.
>   Do not use the ``extern`` keyword with function prototypes as this makes
>   lines longer and isn't strictly necessary.
>   
> +When writing a function declarations, please keep the `order of elements regular
> +<https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/>`_.
> +For example::
> +
> + extern __init void * __must_check void action(enum magic value, size_t size,

Drop that second "void" ?  or what does it mean?
Can __must_check and void be used together?

> + 	u8 count, char *fmt, ...) __printf(4, 5) __malloc;
> +
> +The preferred order of elements for a function prototype is:
> +
> +- storage class (here, ``extern``, and things like ``static __always_inline`` even though
> +  ``__always_inline`` is technically an attribute, it is treated like ``inline``)
> +- storage class attributes (here, ``__init`` -- i.e. section declarations, but also things like ``__cold``)
> +- return type (here, ``void *``)
> +- return type attributes (here, ``__must_check``)

I'm not trying to get you to change this, but I would prefer to see

extern __init __must_check void *action(...) <attributes>;

i.e., with the return type adjacent to the function name.

> +- function name (here, ``action``)
> +- function parameters (here, ``(enum magic value, size_t size, u8 count, char *fmt, ...)``, noting that parameter names should always be included)
> +- function parameter attributes (here, ``__printf(4, 5)``)
> +- function behavior attributes (here, ``__malloc``)
> +
> +Note that for a function definition (e.g. ``static inline``), the compiler does
> +not allow function parameter attributes after the function parameters. In these
> +cases, they should go after the storage class attributes (e.g. note the changed
> +position of ``__printf(4, 5)``)::
> +
> + static __always_inline __init __printf(4, 5) void * __must_check void action(
> + 		enum magic value, size_t size, u8 count, char *fmt, ...)
> + 		__malloc
> + {
> + 	...
> + }
>   
>   7) Centralized exiting of functions
>   -----------------------------------
> 

thanks.
-- 
~Randy

Re: [PATCH v2] docs: Explain the desired position of function attributes

[Kees Cook]

On Thu, Sep 30, 2021 at 01:11:34PM -0700, Randy Dunlap wrote:
> On 9/30/21 12:24 PM, Kees Cook wrote:
> > While discussing how to format the addition of various function
> > attributes, some "unwritten rules" of ordering surfaced[1]. Capture as
> > close as possible to Linus's preferences for future reference.
> > 
> > (Though I note the dissent voiced by Joe Perches, Alexey Dobriyan, and
> > others that would prefer all attributes live on a separate leading line.)
> > 
> > [1] https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/
> > 
> > Signed-off-by: Kees Cook <keescook@chromium.org>
> > ---
> >   Documentation/process/coding-style.rst | 30 ++++++++++++++++++++++++++
> >   1 file changed, 30 insertions(+)
> > 
> > diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
> > index 42969ab37b34..6b4feb1c71e7 100644
> > --- a/Documentation/process/coding-style.rst
> > +++ b/Documentation/process/coding-style.rst
> > @@ -487,6 +487,36 @@ because it is a simple way to add valuable information for the reader.
> >   Do not use the ``extern`` keyword with function prototypes as this makes
> >   lines longer and isn't strictly necessary.
> > +When writing a function declarations, please keep the `order of elements regular
> > +<https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/>`_.
> > +For example::
> > +
> > + extern __init void * __must_check void action(enum magic value, size_t size,
> 
> Drop that second "void" ?  or what does it mean?
> Can __must_check and void be used together?

Gah, thanks. Fixed now in v3.

> 
> > + 	u8 count, char *fmt, ...) __printf(4, 5) __malloc;
> > +
> > +The preferred order of elements for a function prototype is:
> > +
> > +- storage class (here, ``extern``, and things like ``static __always_inline`` even though
> > +  ``__always_inline`` is technically an attribute, it is treated like ``inline``)
> > +- storage class attributes (here, ``__init`` -- i.e. section declarations, but also things like ``__cold``)
> > +- return type (here, ``void *``)
> > +- return type attributes (here, ``__must_check``)
> 
> I'm not trying to get you to change this, but I would prefer to see
> 
> extern __init __must_check void *action(...) <attributes>;
> 
> i.e., with the return type adjacent to the function name.

I have read and re-read Linus's emails, and did a frequency count in the
kernel, and it looks like the preference is [return type] [return type attrs]
but I personally agree with you. :)

# regex I built from __must_check hits...
$ re='((struct .*|void|char) \* ?|((unsigned )?(long|int)|bool|size_t)($| ))'

# type before __must_check
$ git grep -E "$re"'__must_check' | wc -l
746

# type after __must_check
$ git grep -E '\b(static (__always_)?inline )?__must_check($| '"$re"')' | wc -l
297

# type split(!) across __must_check or otherwise weird...
$ git grep -E '\b__must_check\b' | grep -Ev '\b(static (__always_)?inline )?__must_check($| '"$re"')' | grep -Ev "$re"'__must_check\b' | wc -l
44


-- 
Kees Cook

Re: [PATCH v2] docs: Explain the desired position of function attributes

[Joe Perches]

On Thu, 2021-09-30 at 15:52 -0700, Kees Cook wrote:
> I have read and re-read Linus's emails, and did a frequency count in the
> kernel, and it looks like the preference is [return type] [return type attrs]

Please don't read too much into frequency counts as it really depends
on age of code.

> but I personally agree with you. :)
> 
> # regex I built from __must_check hits...
> $ re='((struct .*|void|char) \* ?|((unsigned )?(long|int)|bool|size_t)($| ))'
> 
> # type before __must_check
> $ git grep -E "$re"'__must_check' | wc -l
> 746
> 
> # type after __must_check
> $ git grep -E '\b(static (__always_)?inline )?__must_check($| '"$re"')' | wc -l
> 297

Hmm.

$ git grep -w __must_check -- '*.[ch]' | wc -l
909

Re: [PATCH v2] docs: Explain the desired position of function attributes

[Joe Perches]

On Thu, 2021-09-30 at 12:24 -0700, Kees Cook wrote:
> While discussing how to format the addition of various function
> attributes, some "unwritten rules" of ordering surfaced[1]. Capture as
> close as possible to Linus's preferences for future reference.
> 
> (Though I note the dissent voiced by Joe Perches, Alexey Dobriyan, and
> others that would prefer all attributes live on a separate leading line.)
> 
> [1] https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
>  Documentation/process/coding-style.rst | 30 ++++++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
> 
> diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
> index 42969ab37b34..6b4feb1c71e7 100644
> --- a/Documentation/process/coding-style.rst
> +++ b/Documentation/process/coding-style.rst
> @@ -487,6 +487,36 @@ because it is a simple way to add valuable information for the reader.
>  Do not use the ``extern`` keyword with function prototypes as this makes
>  lines longer and isn't strictly necessary.
>  
> 
> +When writing a function declarations, please keep the `order of elements regular
> +<https://lore.kernel.org/mm-commits/CAHk-=wiOCLRny5aifWNhr621kYrJwhfURsa0vFPeUEm8mF0ufg@mail.gmail.com/>`_.
> +For example::
> +
> + extern __init void * __must_check void action(enum magic value, size_t size,
> + 	u8 count, char *fmt, ...) __printf(4, 5) __malloc;
> +

Read the paragraph above.  extern should not be used in an example.

> +The preferred order of elements for a function prototype is:
> +
> +- storage class (here, ``extern``, and things like ``static __always_inline`` even though
> +  ``__always_inline`` is technically an attribute, it is treated like ``inline``)
> +- storage class attributes (here, ``__init`` -- i.e. section declarations, but also things like ``__cold``)
> +- return type (here, ``void *``)
> +- return type attributes (here, ``__must_check``)
> +- function name (here, ``action``)
> +- function parameters (here, ``(enum magic value, size_t size, u8 count, char *fmt, ...)``, noting that parameter names should always be included)
> +- function parameter attributes (here, ``__printf(4, 5)``)
> +- function behavior attributes (here, ``__malloc``)
> +
> +Note that for a function definition (e.g. ``static inline``), the compiler does
> +not allow function parameter attributes after the function parameters. In these
> +cases, they should go after the storage class attributes (e.g. note the changed
> +position of ``__printf(4, 5)``)::
> +
> + static __always_inline __init __printf(4, 5) void * __must_check void action(
> + 		enum magic value, size_t size, u8 count, char *fmt, ...)
> + 		__malloc
> + {
> + 	...
> + }
>  
> 
>  7) Centralized exiting of functions
>  -----------------------------------