On Wed, 2021-11-17 at 22:43 +0000, Joseph Myers wrote: > On Wed, 17 Nov 2021, Prathamesh Kulkarni via Gcc-patches wrote: > > > More generally, would it be a good idea to provide attributes for > > mod/ref anaylsis ? > > So sth like: > > void foo(void) __attribute__((modifies(errno))); > > which would state that foo modifies errno, but neither reads nor > > modifies any other global var. > > and > > void bar(void) __attribute__((reads(errno))) > > which would state that bar only reads errno, and doesn't modify or > > read any other global var. > > Many math.h functions are const except for possibly setting errno, > possibly raising floating-point exceptions (which might have other > effects > when using alternate exception handling) and possibly reading the > rounding > mode. To represent that, it might be useful for such attributes to > be > able to describe state (such as the floating-point environment) that > doesn't correspond to a C identifier. (errno tends to be a macro, so > referring to it as such in an attribute may be awkward as well.) > > (See also <http://www.open-std.org/jtc1/sc22/wg14/www/docs/n2825.htm> > with > some proposals for features to describe const/pure-like properties of > functions.) >
Thanks for the link. As noted in my reply to Prathamesh, these ideas sound interesting, but this thread seems to be entering scope creep - I don't need these ideas to implement this patch kit (but I do need the attributes specified in the patch, or similar). Do the specific attributes I posted sound reasonable? (without necessarily going in to a full review). If we're thinking longer term, I want the ability to express that a function can have multiple outcomes (e.g. "success" vs "failure" or "found" vs "not found", etc), and it might be good to have a way to attach attributes to those outcomes. Unfortunately the attribute syntax is flat, but maybe there could be a two level hierarchy, something like: int foo (args) __attribute__((outcome("success") __attribute__((return_value(0)))) __attribute__((outcome("failure") __attribute__((return_value_ne(0)) __attribute__((modifies(errno))))); Or given that we're enamored by Lisp-ish DSLs we could go the whole hog and have something like: int foo (args) __attribute ((semantics( "(def-outcomes (success (return-value (eq 0))" " (failure (return-value (ne 0)" " modifies (errno))))"))); which may be over-engineering things :) Going back to the patch itself, returns_zero_on_success/failure get me what I want to express for finding trust boundaries in the Linux kernel, have obvious meaning to a programmer (helpful even w/o compiler support), and could interoperate with one the more elaborate ideas in this thread. Hope this is constructive Dave