Skip to content
Snippets Groups Projects
  1. Jul 04, 2023
  2. Jun 10, 2023
    • Johannes Berg's avatar
      kernel-doc: don't let V=1 change outcome · 56b0f453
      Johannes Berg authored
      
      The kernel-doc script currently reports a number of issues
      only in "verbose" mode, but that's initialized from V=1
      (via KBUILD_VERBOSE), so if you use KDOC_WERROR=1 then
      adding V=1 might actually break the build. This is rather
      unexpected.
      
      Change kernel-doc to not change its behaviour wrt. errors
      (or warnings) when verbose mode is enabled, but rather add
      separate warning flags (and -Wall) for it. Allow enabling
      those flags via environment/make variables in the kernel's
      build system for easier user use, but to not have to parse
      them in the script itself.
      
      Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
      Acked-by: default avatarJonathan Corbet <corbet@lwn.net>
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      56b0f453
  3. Jun 05, 2023
  4. Jan 31, 2023
  5. Jan 22, 2023
  6. Nov 29, 2022
  7. Oct 28, 2022
  8. Oct 18, 2022
  9. Jun 13, 2022
    • Niklas Söderlund's avatar
      scripts: kernel-doc: Always increment warnings counter · df4bf98e
      Niklas Söderlund authored
      
      Some warnings do not increment the warnings counter making the behavior
      of running kernel-doc with -Werror unlogical as some warnings will be
      generated but not treated as errors.
      
      Fix this by creating a helper function that always incrementing the
      warnings counter every time a warning is emitted. There is one location
      in get_sphinx_version() where a warning is not touched as it concerns
      the execution environment of the kernel-doc and not the documentation
      being processed.
      
      Incrementing the counter only have effect when running kernel-doc in
      either verbose mode (-v or environment variable KBUILD_VERBOSE) or when
      treating warnings as errors (-Werror or environment variable
      KDOC_WERROR). In both cases the number of warnings printed is printed to
      stderr and for the later the exit code of kernel-doc is non-zero if
      warnings where encountered.
      
      Simple test case to demo one of the warnings,
      
          $ cat test.c
          /**
           * foo() - Description
           */
          int bar();
      
          # Without this change
          $ ./scripts/kernel-doc -Werror -none test.c
          test.c:4: warning: expecting prototype for foo(). Prototype was for
          bar() instead
      
          # With this change
          $ ./scripts/kernel-doc -Werror -none test.c
          test.c:4: warning: expecting prototype for foo(). Prototype was for
          bar() instead
          1 warnings as Errors
      
      Signed-off-by: default avatarNiklas Söderlund <niklas.soderlund@corigine.com>
      Link: https://lore.kernel.org/r/20220613090510.3088294-1-niklas.soderlund@corigine.com
      
      
      Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      df4bf98e
  10. Mar 28, 2022
  11. Feb 24, 2022
  12. Nov 01, 2021
  13. Oct 18, 2021
    • Kees Cook's avatar
      stddef: Introduce DECLARE_FLEX_ARRAY() helper · 3080ea55
      Kees Cook authored
      There are many places where kernel code wants to have several different
      typed trailing flexible arrays. This would normally be done with multiple
      flexible arrays in a union, but since GCC and Clang don't (on the surface)
      allow this, there have been many open-coded workarounds, usually involving
      neighboring 0-element arrays at the end of a structure. For example,
      instead of something like this:
      
      struct thing {
      	...
      	union {
      		struct type1 foo[];
      		struct type2 bar[];
      	};
      };
      
      code works around the compiler with:
      
      struct thing {
      	...
      	struct type1 foo[0];
      	struct type2 bar[];
      };
      
      Another case is when a flexible array is wanted as the single member
      within a struct (which itself is usually in a union). For example, this
      would be worked around as:
      
      union many {
      	...
      	struct {
      		struct type3 baz[0];
      	};
      };
      
      These kinds of work-arounds cause problems with size checks against such
      zero-element arrays (for example when building with -Warray-bounds and
      -Wzero-length-bounds, and with the coming FORTIFY_SOURCE improvements),
      so they must all be converted to "real" flexible arrays, avoiding warnings
      like this:
      
      fs/hpfs/anode.c: In function 'hpfs_add_sector_to_btree':
      fs/hpfs/anode.c:209:27: warning: array subscript 0 is outside the bounds of an interior zero-length array 'struct bplus_internal_node[0]' [-Wzero-length-bounds]
        209 |    anode->btree.u.internal[0].down = cpu_to_le32(a);
            |    ~~~~~~~~~~~~~~~~~~~~~~~^~~
      In file included from fs/hpfs/hpfs_fn.h:26,
                       from fs/hpfs/anode.c:10:
      fs/hpfs/hpfs.h:412:32: note: while referencing 'internal'
        412 |     struct bplus_internal_node internal[0]; /* (internal) 2-word entries giving
            |                                ^~~~~~~~
      
      drivers/net/can/usb/etas_es58x/es58x_fd.c: In function 'es58x_fd_tx_can_msg':
      drivers/net/can/usb/etas_es58x/es58x_fd.c:360:35: warning: array subscript 65535 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[]'} [-Wzero-length-bounds]
        360 |  tx_can_msg = (typeof(tx_can_msg))&es58x_fd_urb_cmd->raw_msg[msg_len];
            |                                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      In file included from drivers/net/can/usb/etas_es58x/es58x_core.h:22,
                       from drivers/net/can/usb/etas_es58x/es58x_fd.c:17:
      drivers/net/can/usb/etas_es58x/es58x_fd.h:231:6: note: while referencing 'raw_msg'
        231 |   u8 raw_msg[0];
            |      ^~~~~~~
      
      However, it _is_ entirely possible to have one or more flexible arrays
      in a struct or union: it just has to be in another struct. And since it
      cannot be alone in a struct, such a struct must have at least 1 other
      named member -- but that member can be zero sized. Wrap all this nonsense
      into the new DECLARE_FLEX_ARRAY() in support of having flexible arrays
      in unions (or alone in a struct).
      
      As with struct_group(), since this is needed in UAPI headers as well,
      implement the core there, with a non-UAPI wrapper.
      
      Additionally update kernel-doc to understand its existence.
      
      https://github.com/KSPP/linux/issues/137
      
      
      
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      3080ea55
  14. Oct 12, 2021
  15. Sep 25, 2021
    • Kees Cook's avatar
      stddef: Introduce struct_group() helper macro · 50d7bd38
      Kees Cook authored
      
      Kernel code has a regular need to describe groups of members within a
      structure usually when they need to be copied or initialized separately
      from the rest of the surrounding structure. The generally accepted design
      pattern in C is to use a named sub-struct:
      
      	struct foo {
      		int one;
      		struct {
      			int two;
      			int three, four;
      		} thing;
      		int five;
      	};
      
      This would allow for traditional references and sizing:
      
      	memcpy(&dst.thing, &src.thing, sizeof(dst.thing));
      
      However, doing this would mean that referencing struct members enclosed
      by such named structs would always require including the sub-struct name
      in identifiers:
      
      	do_something(dst.thing.three);
      
      This has tended to be quite inflexible, especially when such groupings
      need to be added to established code which causes huge naming churn.
      Three workarounds exist in the kernel for this problem, and each have
      other negative properties.
      
      To avoid the naming churn, there is a design pattern of adding macro
      aliases for the named struct:
      
      	#define f_three thing.three
      
      This ends up polluting the global namespace, and makes it difficult to
      search for identifiers.
      
      Another common work-around in kernel code avoids the pollution by avoiding
      the named struct entirely, instead identifying the group's boundaries using
      either a pair of empty anonymous structs of a pair of zero-element arrays:
      
      	struct foo {
      		int one;
      		struct { } start;
      		int two;
      		int three, four;
      		struct { } finish;
      		int five;
      	};
      
      	struct foo {
      		int one;
      		int start[0];
      		int two;
      		int three, four;
      		int finish[0];
      		int five;
      	};
      
      This allows code to avoid needing to use a sub-struct named for member
      references within the surrounding structure, but loses the benefits of
      being able to actually use such a struct, making it rather fragile. Using
      these requires open-coded calculation of sizes and offsets. The efforts
      made to avoid common mistakes include lots of comments, or adding various
      BUILD_BUG_ON()s. Such code is left with no way for the compiler to reason
      about the boundaries (e.g. the "start" object looks like it's 0 bytes
      in length), making bounds checking depend on open-coded calculations:
      
      	if (length > offsetof(struct foo, finish) -
      		     offsetof(struct foo, start))
      		return -EINVAL;
      	memcpy(&dst.start, &src.start, offsetof(struct foo, finish) -
      				       offsetof(struct foo, start));
      
      However, the vast majority of places in the kernel that operate on
      groups of members do so without any identification of the grouping,
      relying either on comments or implicit knowledge of the struct contents,
      which is even harder for the compiler to reason about, and results in
      even more fragile manual sizing, usually depending on member locations
      outside of the region (e.g. to copy "two" and "three", use the start of
      "four" to find the size):
      
      	BUILD_BUG_ON((offsetof(struct foo, four) <
      		      offsetof(struct foo, two)) ||
      		     (offsetof(struct foo, four) <
      		      offsetof(struct foo, three));
      	if (length > offsetof(struct foo, four) -
      		     offsetof(struct foo, two))
      		return -EINVAL;
      	memcpy(&dst.two, &src.two, length);
      
      In order to have a regular programmatic way to describe a struct
      region that can be used for references and sizing, can be examined for
      bounds checking, avoids forcing the use of intermediate identifiers,
      and avoids polluting the global namespace, introduce the struct_group()
      macro. This macro wraps the member declarations to create an anonymous
      union of an anonymous struct (no intermediate name) and a named struct
      (for references and sizing):
      
      	struct foo {
      		int one;
      		struct_group(thing,
      			int two;
      			int three, four;
      		);
      		int five;
      	};
      
      	if (length > sizeof(src.thing))
      		return -EINVAL;
      	memcpy(&dst.thing, &src.thing, length);
      	do_something(dst.three);
      
      There are some rare cases where the resulting struct_group() needs
      attributes added, so struct_group_attr() is also introduced to allow
      for specifying struct attributes (e.g. __align(x) or __packed).
      Additionally, there are places where such declarations would like to
      have the struct be tagged, so struct_group_tagged() is added.
      
      Given there is a need for a handful of UAPI uses too, the underlying
      __struct_group() macro has been defined in UAPI so it can be used there
      too.
      
      To avoid confusing scripts/kernel-doc, hide the macro from its struct
      parsing.
      
      Co-developed-by: default avatarKeith Packard <keithp@keithp.com>
      Signed-off-by: default avatarKeith Packard <keithp@keithp.com>
      Acked-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
      Link: https://lore.kernel.org/lkml/20210728023217.GC35706@embeddedor
      
      
      Enhanced-by: default avatarRasmus Villemoes <linux@rasmusvillemoes.dk>
      Link: https://lore.kernel.org/lkml/41183a98-bdb9-4ad6-7eab-5a7292a6df84@rasmusvillemoes.dk
      
      
      Enhanced-by: default avatarDan Williams <dan.j.williams@intel.com>
      Link: https://lore.kernel.org/lkml/1d9a2e6df2a9a35b2cdd50a9a68cac5991e7e5f0.camel@intel.com
      
      
      Enhanced-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://lore.kernel.org/lkml/YQKa76A6XuFqgM03@phenom.ffwll.local
      
      
      Acked-by: default avatarDan Williams <dan.j.williams@intel.com>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      50d7bd38
  16. Aug 12, 2021
  17. May 17, 2021
  18. Apr 27, 2021
  19. Apr 15, 2021
  20. Mar 29, 2021
  21. Mar 26, 2021
  22. Mar 25, 2021
  23. Mar 09, 2021
  24. Mar 08, 2021
  25. Mar 07, 2021
  26. Feb 22, 2021
  27. Jan 28, 2021
  28. Jan 18, 2021
    • Mauro Carvalho Chehab's avatar
      scripts: kernel-doc: validate kernel-doc markup with the actual names · 52042e2d
      Mauro Carvalho Chehab authored
      
      Kernel-doc currently expects that the kernel-doc markup to come
      just before the function/enum/struct/union/typedef prototype.
      
      Yet, if it find things like:
      
      	/**
      	 * refcount_add - add a value to a refcount
      	 * @i: the value to add to the refcount
      	 * @r: the refcount
      	 */
      	static inline void __refcount_add(int i, refcount_t *r, int *oldp);
      	static inline void refcount_add(int i, refcount_t *r);
      
      Kernel-doc will do the wrong thing:
      
      	foobar.h:6: warning: Function parameter or member 'oldp' not described in '__refcount_add'
      	.. c:function:: void __refcount_add (int i, refcount_t *r, int *oldp)
      
      	   add a value to a refcount
      
      	**Parameters**
      
      	``int i``
      	  the value to add to the refcount
      
      	``refcount_t *r``
      	  the refcount
      
      	``int *oldp``
      	  *undescribed*
      
      Basically, it will document "__refcount_add" with the kernel-doc
      markup for refcount_add.
      
      If both functions have the same arguments, this won't even
      produce any warning!
      
      Add a logic to check if the kernel-doc identifier matches the actual
      name of the C function or data structure that will be documented.
      
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
      Link: https://lore.kernel.org/r/081546f141a496d6cabb99a4adc140444c705e93.1610610937.git.mchehab+huawei@kernel.org
      
      
      Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      52042e2d
  29. Dec 03, 2020
Loading