Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <0db131cf-013e-6f0e-c90b-5c1e840d869c@nvidia.com>
Date:   Wed, 24 Aug 2022 14:59:25 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.12.0
Subject: Re: [PATCH RFC 1/2] coding-style.rst: document BUG() and WARN() rules
 ("do not crash the kernel")
Content-Language: en-US
To:     David Hildenbrand <david@redhat.com>, linux-kernel@vger.kernel.org
Cc:     linux-mm@kvack.org, linux-doc@vger.kernel.org,
        kexec@lists.infradead.org,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Ingo Molnar <mingo@kernel.org>,
        David Laight <David.Laight@ACULAB.COM>,
        Jonathan Corbet <corbet@lwn.net>,
        Andy Whitcroft <apw@canonical.com>,
        Joe Perches <joe@perches.com>,
        Dwaipayan Ray <dwaipayanray1@gmail.com>,
        Lukas Bulwahn <lukas.bulwahn@gmail.com>,
        Baoquan He <bhe@redhat.com>, Vivek Goyal <vgoyal@redhat.com>,
        Dave Young <dyoung@redhat.com>
References: <20220824163100.224449-1-david@redhat.com>
 <20220824163100.224449-2-david@redhat.com>
From:   John Hubbard <jhubbard@nvidia.com>
In-Reply-To: <20220824163100.224449-2-david@redhat.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?a1hBNm9OaVdGZlFsaUR5djNSQ1o2SnNKWnVidUFTd1ZTYmJUQTlCZzlPWjVx?=
 =?utf-8?B?NEtSbmxZYjFQeElFYkhMaVF3bWN4NFBJN1M1ekswekRKaXVBZjJEamZwTW5n?=
 =?utf-8?B?OG5zQ3NORWl1blFCRmtoc1FBUGtCa2RvQ1pqRURMOEtsS2kxTmVwQVc2czli?=
 =?utf-8?B?czF5dnI3YnhyQTh0Ulh2U2h1bUZRQkZUMWVKZzVSWFZBcGM5OHNWb1RNbXl2?=
 =?utf-8?B?aG5FQUsyTHN1Q3dVU1dZSzBmVkQ0eFRZUGNQaURTeCttNklnQzAxYVhrZjRl?=
 =?utf-8?B?MVRXZjU3M2RFL2xtL0ZOMGtDZ29jSG1wTW9CT0VBYmluc005K1JVTW1IK3Fx?=
 =?utf-8?B?Y2dTbGhEU0JzWHBTbm1nakpPcGdsVW9vZmFqRmRXY0FnV2t5cnlpVXdLK3Yx?=
 =?utf-8?B?a3VvZjRzWXRDVWlkcEM0VDc1Y2hXZHJYR1cvU25WdFczNVN0Q2pvQm10MTRQ?=
 =?utf-8?B?UEZTYVRKRmNGYXFlNUpBR1BNL1ozZkg3b21UTGVyUnBrckwybkswWlRweFEz?=
 =?utf-8?B?djhRVUx2Q0Fjb3ladnBsM01rRlR2ZHo0TklmOVFtS0FzN29WWU5FQUF0Y0FL?=
 =?utf-8?B?dmpJVzVLYWJSeXNNSUF1OGoxMVBzUFl5Qk1PVVFPQnZPcVRMWVBZYldhR1Jn?=
 =?utf-8?B?Nk5ZbmQwMjlacVkvRTg1MnZpT0JnWVpZNDhHbnpUclQ0ZmpuSVZsK2dqSSti?=
 =?utf-8?B?T1JwdGdMazhjbkRDR2Fzem5PcThoMS80c2lFWUVmLzRkM2Z6OFExcDIyemR6?=
 =?utf-8?B?RzhWQUF4TDZ0QkdkcGUxOFpRWk1LR3BFalJZVDdybnpZTkRpbVNsb1o0ZFoz?=
 =?utf-8?B?cWVFVS9iVmo3R1JjdG9LdmExbmNnYzZzOTA0bHg0UHl5WUptYWxNMGVDZnFJ?=
 =?utf-8?B?bm42MTZYcHBidFlEVUN2Vzk1RWFWUzQzTTd0ZDlPbXVXTld4QUxQaFU2OWlm?=
 =?utf-8?B?aHNSYUM4UmNQV3RJNm5JVUpRWndzcmFMWkx1dHQ4clc0NERpM0R0RHZ1WjVR?=
 =?utf-8?B?S1p3U01LZ0U4cjNKaGI2Z3k4N0NqNHI3Wk5DcmhvTkhoeEM2TlF1SHBZOWJV?=
 =?utf-8?B?N2FtMnFFZS85TEhYc3EwZDVwUWpHQlZBSklNMmFaT2FYRVd2WTRCbW5RRWo1?=
 =?utf-8?B?Vkd1NlBNQldMQnFVeGFqZktlQzZCa0Q3YzdwUXVwcHlFdklPQzFDb2x0Ky9H?=
 =?utf-8?B?ZVB2SE55eWUrM3JUY0Z5YmFQc01rYjdpZTNqZlRQQ1Jjdnd1MXlEODF1TW1H?=
 =?utf-8?B?cUtqQ2RibEJZM2ZlalA1TFJDMFlvajNqdEt3NVA0SExFSm5McmtmUXg2bk9w?=
 =?utf-8?B?Q2NoNUl1dk5TR2hIWFVJNGIzcHVZV3Z3Z0drM3VtQUsrLzZsa0J2VXllMkdB?=
 =?utf-8?B?ZU1vVS9JTHRCNjJWMTM3UUlvd1F1SjJJb2hMU3hHYVJaTkhvQTNDK09POTNw?=
 =?utf-8?B?U1J5NzFaQWtLNXBVanB1aDF1RzlSUExVeENqMi9CZjhEM3pZd21rVHRaM3NI?=
 =?utf-8?B?TnlMY09wengxUm5aazljTUxSUy9Mam5nWXZDd25yaXlhQW5mS1NsdU5QZU1B?=
 =?utf-8?B?N1ZMdFhmVEt6ZXdveGcrd05VdW9jWFU0eGY1bHVMQmlZNDAyN2xtbkxqblJu?=
 =?utf-8?B?Wm9jci9xMldGRlZNWTVBM1Rrc2Vrck9PaVoxUW5UVzNKQ2NNblpEWTdpVkVF?=
 =?utf-8?B?Q2ZYZ05QN05LcjNrd0xnU0wxZm02QkxMMkFIdTU4R0FSNTNTcWFHUUt4UWpo?=
 =?utf-8?B?U1dmRkl3ZGhJZmEwUjhQcW9EbkZPSXBYR29TeUhHR3VzM2VhMWlGck5oUFdB?=
 =?utf-8?B?Yll2dnVGaWJDWXlFZHJHMngxZjN1MWpBOUxoK1ZjcXVRVC93TU1td0Z1UTJC?=
 =?utf-8?B?dDI4WHJNWjcxSTlLaGd3alI2Mi9EUG5nREtxdlIvM05MT1ZMRHBTWWZTSFVO?=
 =?utf-8?B?SHV5SnFUMmxwTllsRXRiY3hCRHp3bnhEYUNlbkpKZU9GdUZnanYyVzlZbSt1?=
 =?utf-8?B?bVkwNnMxZVFnZ0RTY3RuZThtS0Z5N2p0U0FhQjM5UXBCU3Z6NS9HZGRidTJI?=
 =?utf-8?B?NHpLbGlOdFJsZDM3VWhzZnl3dU5kTDgzZmVwc1BRd0R1K2NYcTY2Z28yNGVM?=
 =?utf-8?Q?0I0eL0InS/RRilKyGH++SVqvE?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: c84b96ef-6d36-4b79-5912-08da861bea1d
X-MS-Exchange-CrossTenant-AuthSource: BY5PR12MB4130.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 24 Aug 2022 21:59:27.8252
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 59q+8kcAnee4WpOp5lb4eHbnUBNQmiSlUCI1x/t6+nUP3rfKEJKfxoelTJsN8btWXvSyNKajIxDl0dh0Y35fGQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR12MB3590
X-Spam-Status: No, score=-1.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH,
        DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,
        NICE_REPLY_A,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,
        SPF_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=no
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 8/24/22 09:30, David Hildenbrand wrote:
> diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
> index 03eb53fd029a..a6d81ff578fe 100644
> --- a/Documentation/process/coding-style.rst
> +++ b/Documentation/process/coding-style.rst
> @@ -1186,6 +1186,33 @@ expression used.  For instance:
>  	#endif /* CONFIG_SOMETHING */
>  

I like the idea of adding this documentation, and this is the right
place. Naturally, if one likes something, one must immediately change
it. :) Therefore, here is an alternative writeup that I think captures
what you and the email threads were saying.

How's this sound?

diff --git a/Documentation/process/coding-style.rst b/Documentation/process/coding-style.rst
index 03eb53fd029a..32df0d503388 100644
--- a/Documentation/process/coding-style.rst
+++ b/Documentation/process/coding-style.rst
@@ -1185,6 +1185,53 @@ expression used.  For instance:
        ...
        #endif /* CONFIG_SOMETHING */
 
+22) Do not crash the kernel
+---------------------------
+
+Use WARN() rather than BUG()
+****************************
+
+Do not add new code that uses any of the BUG() variants, such as BUG(),
+BUG_ON(), or VM_BUG_ON(). Instead, use a WARN*() variant, preferably
+WARN_ON_ONCE(), and possibly with recovery code. Recovery code is not required
+if there is no reasonable way to at least partially recover.
+
+Use WARN_ON_ONCE() rather than WARN() or WARN_ON()
+**************************************************
+
+WARN_ON_ONCE() is generally preferred over WARN() or WARN_ON(), because it is
+common for a given warning condition, if it occurs at all, to occur multiple
+times. (For example, once per file, or once per struct page.) This can fill up
+and wrap the kernel log, and can even slow the system enough that the excessive
+logging turns into its own, additional problem.
+
+Do not WARN lightly
+*******************
+
+WARN*() is intended for unexpected, this-should-never-happen situations. WARN*()
+macros are not to be used for anything that is expected to happen during normal
+operation. These are not pre- or post-condition asserts, for example. Again:
+WARN*() must not be used for a condition that is expected to trigger easily, for
+example, by user space actions. pr_warn_once() is a possible alternative, if you
+need to notify the user of a problem.
+
+Do not worry about panic_on_warn users
+**************************************
+
+A few more words about panic_on_warn: Remember that ``panic_on_warn`` is an
+available kernel option, and that many users set this option. This is why there
+is a "Do not WARN lightly" writeup, above. However, the existence of
+panic_on_warn users is not a valid reason to avoid the judicious use WARN*().
+That is because, whoever enables panic_on_warn has explicitly asked the kernel
+to crash if a WARN*() fires, and such users must be prepared to deal with the
+consequences of a system that is somewhat more likely to crash.
+
+Use BUILD_BUG_ON() for compile-time assertions
+**********************************************
+
+The use of BUILD_BUG_ON() is acceptable and encouraged, because it is a
+compile-time assertion that has no effect at runtime.


thanks,

-- 
John Hubbard
NVIDIA