4 ms·

I'm definitely on-board these days with the typedef-everything approach used by NT. Every public function gets a typedef with SAL annotations exposed in the mo

I'm definitely on-board these days with the typedef-everything approach used by NT. Every public function gets a typedef with SAL annotations exposed in the module's public header file, e.g. in this case, TraceStore.h has: typedef _Check_return_ _Success_(return != 0) PVOID (ALLOCATE_RECORDS_WITH_TIMESTAMP)( _In_ PTRACE_CONTEXT TraceContext, _In_ PTRACE_STORE TraceStore, _In_ ULONG_PTR NumberOfRecords, _In_ ULONG_PTR RecordSize, _In_opt_ PLARGE_INTEGER TimestampPointer ); typedef ALLOCATE_RECORDS_WITH_TIMESTAMP *PALLOCATE_RECORDS_WITH_TIMESTAMP; typedef PALLOCATE_RECORDS_WITH_TIMESTAMP \ volatile VPALLOCATE_RECORDS_WITH_TIMESTAMP; That allows me to include it in a public struct via: typedef struct _TRACE_STORE { ... VPALLOCATE_RECORDS_WITH_TIMESTAMP AllocateRecordsWithTimestamp; ... } TRACE_STORE, *PTRACE_STORE; Basically I've resigned to living with the ugliest possible function typedefs, complete with SAL annotations and whatnot, at the benefit of much cleaner interaction elsewhere in the code, e.g. to call it I'd just do: Foo = (PFOO)TraceStore->AllocateRecordsWithTimestamp( TraceContext, TraceStore, 4, sizeof(*Foo), &Timestamp ); _Use_decl_annotations is a life saver.

quotemstr 10y ago
Oh, sure. I miss SAL terribly. The consensus outside Microsoft seems to be that we need annotation-less static analysis because developers will never add annotations --- annotation-less static analysis, IME, has a much higher false positive rate than prefast. Windows is proof that extremely robust static analysis works. Back when I was in Windows, the system was so robust that if the static analyzer reported on your code, it was your code that had the problem, not the analyzer. It did bounds checking, nullability analysis, and tons of useful stuff. It's fantastic. The thing about NT-style pointer typedefs is that they discourage const-correctness: it's enough of a pain to make a PFOO. You want a PCFOO too? That said, I'd be more than happy to live with poiner typedefs if I got SAL back. BTW, I also used a hacked-up cc-mode that understood all the SAL annotations and fontified them using font-lock-keyword-face. It worked great.
- trentnelson 10y ago
  Ah, yeah, const-correctness definitely gets way more tedious, but eh, just like the ugly as sin typedefs, I think it's a net win. I've been contemplating doing a little project that scans all the SDK/DDK headers for SAL annotations in use and making a big cross-reference where you can, like, click on the #defines in <sal.h> and see all the places where there are real examples of it being used. Some of the complex uses are really hard to grok just from MSDN documentation alone; I've found looking around at the WDK/DDK headers much more useful. Unrelated question: why'd you leave Microsoft? Were you doing NT kernel development there? Is that what you've done in the past?

quotemstr 10y ago

Oh, sure. I miss SAL terribly. The consensus outside Microsoft seems to be that we need annotation-less static analysis because developers will never add annotations --- annotation-less static analysis, IME, has a much higher false positive rate than prefast. Windows is proof that extremely robust static analysis works. Back when I was in Windows, the system was so robust that if the static analyzer reported on your code, it was your code that had the problem, not the analyzer. It did bounds checking, nullability analysis, and tons of useful stuff. It's fantastic. The thing about NT-style pointer typedefs is that they discourage const-correctness: it's enough of a pain to make a PFOO. You want a PCFOO too? That said, I'd be more than happy to live with poiner typedefs if I got SAL back. BTW, I also used a hacked-up cc-mode that understood all the SAL annotations and fontified them using font-lock-keyword-face. It worked great.

trentnelson 10y ago
Ah, yeah, const-correctness definitely gets way more tedious, but eh, just like the ugly as sin typedefs, I think it's a net win. I've been contemplating doing a little project that scans all the SDK/DDK headers for SAL annotations in use and making a big cross-reference where you can, like, click on the #defines in <sal.h> and see all the places where there are real examples of it being used. Some of the complex uses are really hard to grok just from MSDN documentation alone; I've found looking around at the WDK/DDK headers much more useful. Unrelated question: why'd you leave Microsoft? Were you doing NT kernel development there? Is that what you've done in the past?