Re: [XEN PATCH 7/7] xen/page_alloc: deviate first_valid_mfn for MISRA C Rule 8.4

[Julien Grall <julien@xxxxxxx>]

Hi,

On 02/12/2023 04:03, Stefano Stabellini wrote:
> On Fri, 1 Dec 2023, Jan Beulich wrote:
> > On 01.12.2023 03:47, Stefano Stabellini wrote:
> > > On Wed, 29 Nov 2023, Nicola Vetrini wrote:
> > > > No functional change.
> > > >
> > > > Signed-off-by: Nicola Vetrini <nicola.vetrini@xxxxxxxxxxx>
> > > > ---
> > > > The preferred way to deviate is to use asmlinkage, but this modification is only
> > > > the consequence of NUMA on ARM (and possibly PPC) being a work in progress.
> > > > As stated in the comment above the textual deviation, first_valid_mfn will
> > > > likely then become static and there would be no need for the comment anymore.
> > > > This works towards having the analysis for this rule clean (i.e. no violations);
> > > > the interest in having a clean rule is that then it could be used to signal
> > > > newly introduced violations by making the analysis job fail.
> > > Please add this text as part of the commit message. It can be done on
> > > commit.
> > I assume you saw my reply on another of the patches in this series as to
> > asmlinkage use on variables? IOW I think this paragraph would also need
> > adjustment to account for that.
> I was going to ask you about that: reading your reply
> https://marc.info/?l=xen-devel&m=170142048615336 it is not clear to me
> what you are asking or suggesting as next step in regard to asmlinkage
> use on variables.
Regardless what Jan wrote there, I think it would be an abuse to add 
asmlinkage for first_valid_mfn because it is not used by assembly code.
The same goes for the use of SAF-1-safe. This is defined as:

"Functions and variables used only by asm modules do not need to have a 
visible declaration prior to their definition."
Now, regarding the violation itself. AFAIU, this would be a violation 
only on x86 because Arm, PPC, RISC-V will all need the declaration as 
NUMA is not supported. For Arm, we may have NUMA support soon, but I 
doubt this will happen in the next couple of years for the others.
Furthermore, I am sure this is not the only exported variable/function 
which may be used by some archictectures but not others. So I think it 
would be better to declare first_valid_mfn in a common header.
Cheers,

--
Julien Grall