1813

I bumped into this strange macro code in /usr/include/linux/kernel.h:

/* Force a compilation error if condition is true, but also produce a result (of value 0 and type size_t), so the expression can be used e.g. in a structure initializer (or where-ever else comma expressions aren't permitted). */ #define BUILD_BUG_ON_ZERO(e) (sizeof(struct { int:-!!(e); })) #define BUILD_BUG_ON_NULL(e) ((void *)sizeof(struct { int:-!!(e); }))

What does :-!! do?

Update: In recent times, the macro has been moved to /usr/include/linux/build_bug.h

Improve this question
6
  • 2
    - Unary minus <br /> ! Logical NOT <br /> inverse not not of the given Integer e so the variable can either be 0 or 1. Commented Feb 10, 2012 at 14:58
  • 85
    git blame tells us that this particular form of static assertion was introduced by Jan Beulich in 8c87df4. Obviously he had good reasons to do it (see the commit message). Commented Feb 10, 2012 at 16:34
  • 2
    Almost goes without saying that the bitfield created is an anonymous one. This is in the same spirit as C++ template meta-programming, i.e. have things happen at compile time that can be checked at compile time. Commented Feb 16, 2012 at 3:05
  • 3
    @cpcloud, sizeof does "evaluate" the type, just not the value. Its the type thats invalid in this case. Commented Mar 24, 2012 at 17:19
  • 1
    Several of the answers mention that :0 gives a zero-sized anonymous bit-field, and therefore a zero-sized struct. That's not quite true; in standard C, :0 is not any kind of field declaration (you can't give it a name) but rather a directive to start the next bit-field on the next word boundary (typically int but not necessarily). It doesn't normally have any significance unless used between two (otherwise adjacent) bit-field declarations. The resulting struct is zero-sized because it contains no declarations; and that of course is a gcc extension. Commented Aug 18, 2022 at 5:24

6 Answers 6

Reset to default
1811

This is, in effect, a way to check whether the expression e can be evaluated to be 0, and if not, to fail the build.

The macro is somewhat misnamed; it should be something more like BUILD_BUG_OR_ZERO, rather than ...ON_ZERO. (There have been occasional discussions about whether this is a confusing name.)

You should read the expression like this:

sizeof(struct { int: -!!(e); }))

  1. (e): Compute expression e.

  2. !!(e): Logically negate twice: 0 if e == 0; otherwise 1.

  3. -!!(e): Numerically negate the expression from step 2: 0 if it was 0; otherwise -1.

  4. struct{int: -!!(0);} --> struct{int: 0;}: If it was zero, then we declare a struct with an anonymous integer bitfield that has width zero. Everything is fine and we proceed as normal.

  5. struct{int: -!!(1);} --> struct{int: -1;}: On the other hand, if it isn't zero, then it will be some negative number. Declaring any bitfield with negative width is a compilation error.

So we'll either wind up with a bitfield that has width 0 in a struct, which is fine, or a bitfield with negative width, which is a compilation error. Then we take sizeof that field, so we get a size_t with the appropriate width (which will be zero in the case where e is zero).

Some people have asked: Why not just use an assert?

keithmo's answer here has a good response:

These macros implement a compile-time test, while assert() is a run-time test.

Exactly right. You don't want to detect problems in your kernel at runtime that could have been caught earlier! It's a critical piece of the operating system. To whatever extent problems can be detected at compile time, so much the better.

Improve this answer
Sign up to request clarification or add additional context in comments.

24 Comments

recent variants of C++ or C standards have something like static_assert for related purposes.
@Lundin - #error would require use of 3 lines of code #if/#error/#endif, and would only work for evaluations accessible to the pre-processor. This hack works for any evaluation accessible to the compiler.
The Linux kernel does not use C++, at least not while Linus is still alive.
@Dolda2000: "Boolean expressions in C are defined to always evaluate to zero or one" -- Not exactly. The operators that yield "logically boolean" results (!, <, >, <=, >=, ==, !=, &&, ||) always yield 0 or 1. Other expressions may yield results that may be used as a conditions, but are merely zero or non-zero; for example, isdigit(c), where c is a digit, can yield any non-zero value (which is then treated as true in a condition).
Quick note about the name. It's called ...ON_ZERO because it's a derivative of BUG_ON, a macro that's essentially an assertion. BUG_ON(foo) means "it's a bug if foo is true" (at runtime). Conversely, BUILD_BUG_ON is a static assertion (checked at build time), and finally BUILD_BUG_ON_ZERO is exactly the same, except that the whole thing is an expression equal to (size_t)0, as the comment in the question states.
|
277

The : is a bitfield. As for !!, that is logical double negation and so returns 0 for false or 1 for true. And the - is a minus sign, i.e. arithmetic negation.

It's all just a trick to get the compiler to barf on invalid inputs.

Consider BUILD_BUG_ON_ZERO. When -!!(e) evaluates to a negative value, that produces a compile error. Otherwise -!!(e) evaluates to 0, and a 0 width bitfield has size of 0. And hence the macro evaluates to a size_t with value 0.

The name is weak in my view because the build in fact fails when the input is not zero.

BUILD_BUG_ON_NULL is very similar, but yields a pointer rather than an int.

Improve this answer

11 Comments

is sizeof(struct { int:0; }) strictly conforming?
Why would the result in general be 0? A struct with only an empty bitfield, true, but I don't think that struct with size 0 are allowed. E.g if you'd create an array of that type, the individual array elements still must have different addresses, no?
they actually don't care as as they use GNU extensions, they disable strict aliasing rule and don't consider integer overflows as UB. But I was wondering if this is strictly conforming C.
@ouah regarding unnamed zero length bitfields, see here: stackoverflow.com/questions/4297095/…
@DavidHeffernan actually C allows unamed bit-field of 0 width, but not if there no other named member in the structure. (C99, 6.7.2.1p2) "If the struct-declaration-list contains no named members, the behavior is undefined." So for example sizeof (struct {int a:1; int:0;}) is strictly conforming but sizeof(struct { int:0; }) is not (undefined behavior).
|
179

Some people seem to be confusing these macros with assert().

These macros implement a compile-time test, while assert() is a runtime test.

Update:

As of C11, the _Static_assert() keyword is available to create compile time tests, and should be used unless code is being written for old compilers.

Improve this answer

Comments

58

Well, I am quite surprised that the alternatives to this syntax have not been mentioned. Another common (but older) mechanism is to call a function that isn't defined and rely on the optimizer to compile-out the function call if your assertion is correct.

#define MY_COMPILETIME_ASSERT(test) \ do { \ extern void you_did_something_bad(void); \ if (!(test)) \ you_did_something_bad(void); \ } while (0)

While this mechanism works (as long as optimizations are enabled) it has the downside of not reporting an error until you link, at which time it fails to find the definition for the function you_did_something_bad(). That's why kernel developers starting using tricks like the negative sized bit-field widths and the negative-sized arrays (the later of which stopped breaking builds in GCC 4.4).

In sympathy for the need for compile-time assertions, GCC 4.3 introduced the error function attribute that allows you to extend upon this older concept, but generate a compile-time error with a message of your choosing -- no more cryptic "negative sized array" error messages!

#define MAKE_SURE_THIS_IS_FIVE(number) \ do { \ extern void this_isnt_five(void) __attribute__((error( \ "I asked for five and you gave me " #number))); \ if ((number) != 5) \ this_isnt_five(); \ } while (0)

In fact, as of Linux 3.9, we now have a macro called compiletime_assert which uses this feature and most of the macros in bug.h have been updated accordingly. Still, this macro can't be used as an initializer. However, using by statement expressions (another GCC C-extension), you can!

#define ANY_NUMBER_BUT_FIVE(number) \ ({ \ typeof(number) n = (number); \ extern void this_number_is_five(void) __attribute__(( \ error("I told you not to give me a five!"))); \ if (n == 5) \ this_number_is_five(); \ n; \ })

This macro will evaluate its parameter exactly once (in case it has side-effects) and create a compile-time error that says "I told you not to give me a five!" if the expression evaluates to five or is not a compile-time constant.

So why aren't we using this instead of negative-sized bit-fields? Alas, there are currently many restrictions of the use of statement expressions, including their use as constant initializers (for enum constants, bit-field width, etc.) even if the statement expression is completely constant its self (i.e., can be fully evaluated at compile-time and otherwise passes the __builtin_constant_p() test). Further, they cannot be used outside of a function body.

Hopefully, GCC will amend these shortcomings soon and allow constant statement expressions to be used as constant initializers. The challenge here is the language specification defining what is a legal constant expression. C++11 added the constexpr keyword for just this type or thing, but no counterpart exists in C11. While C11 did get static assertions, which will solve part of this problem, it wont solve all of these shortcomings. So I hope that gcc can make a constexpr functionality available as an extension via -std=gnuc99 & -std=gnuc11 or some such and allow its use on statement expressions et. al.

Improve this answer

4 Comments

All of your solutions are NOT alternatives. The comment above the macro is pretty clear "so the expression can be used e.g. in a structure initializer (or where-ever else comma expressions aren't permitted)." The macro returns an expression of type size_t
@Wiz Yes, I am aware of this. Perhaps this was a bit verbose and maybe I need to re-visit my wording, but my point was to explore the various mechanisms for static assertions and show why we're still using negative sized bitfields. In short, if we get a mechanism for constant statement expression, we will have other options open.
Anyway we can't use these macro for a variable. right? error: bit-field ‘<anonymous>’ width not an integer constant Its allowing only constants. So, what's the use?
@Karthik Search the sources of the Linux kernel to see why it's used.
39

It's creating a size 0 bitfield if the condition is false, but a size -1 (-!!1) bitfield if the condition is true/non-zero. In the former case, there is no error and the struct is initialized with an int member. In the latter case, there is a compile error (and no such thing as a size -1 bitfield is created, of course).

Improve this answer

1 Comment

Actually it's returning a size_t with value 0 in case the condition is true.
0

This is your typical smelly old *nix bugware.

  • Problem 1) The macro BUILD_BUG_ON_ZERO causes a compiler error in case the expression is not zero. So the name is already very confusing.

What the code does:

Essentially this is a pre-C11 static assert. Other answers have mostly explained what the code does. It attempts to declare a bit-field. There's a constraint in ISO C23 6.7.3.2:

The expression that specifies the width of a bit-field shall be an integer constant expression with a nonnegative value that does not exceed the width of an object of the type that would be specified were the colon and expression omitted. If the value is zero, the declaration shall have no declarator.

As we can tell from the above, the bit-field size may not be non-negative. Specifically, a bit-field with size zero means the end of a previous bit-field:

As a special case, a bit-field structure member with a width of zero indicates that no further bit-field is to be packed into the unit in which the previous bit-field, if any, was placed.

!! turns any expression into a boolean one of type int, so we end up with either 0 or 1, which is a signed temporary value.

-1 would violate the previously quoted constraint of declaring negative bit-fields. So far it all seems good. However...

  • Problem 2) A struct with no named members isn't well-defined behavior in C or GNU C. Also from 6.7.3.2, emphasis mine:

    The member declaration list is a sequence of declarations for the members of the structure or union. If the member declaration list does not contain any named members, either directly or via an anonymous structure or anonymous union, the behavior is undefined

The gcc compiler helpfully lets you know of this severe bug if you compile with -pedantic.

Now GNU C does explicitly allow a struct with no members as a language extension. However this isn't really the case here: we do have a member but it has no name. The gcc manual doesn't cover the case as a valid extension, so the behavior of the code is both undefined and undocumented. Taking the size of such a struct does not appear to be well-defined either.

So the macro essentially introduces yet another bug in the code no matter the outcome.

Better written, well-defined code would have been struct { int dummy:1; int:-!!(e); }, however that will return a non-zero size. Alternatively struct { int:-!!(e); int dummy[]; } should return size zero.

How to fix?

_Static_assert or static_assert is the obvious choice. C programmers are expected to know of these language features, so the whole BUILD_BUG_ON_ZERO macro is obsolescent since quite a while back.

Static asserts are declarations, so they may be present inside struct/union declarations. If you want it to also generate some sort of dummy value in case the assertion passed, that can be done like this:

#define STATIC_ASSERT_PLUS(expr) ( (struct { int val; static_assert((expr), "optional error message"); }){0}.val )

This creates a compound literal containing an unnamed struct, which is initialized to zero. It has the reverse/corrected logic of BUILD_BUG_ON_ZERO so this macro will create a compiler error on zero. In this case it returns value 0 of type int but it can easily be modified to use another type or value. This code is pure ISO C (C11 or later).

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.