lkml.org 
[lkml]   [2022]   [Aug]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v9 06/27] rust: add C helpers
    On Fri, Aug 05, 2022 at 05:41:51PM +0200, Miguel Ojeda wrote:
    > This source file contains forwarders to C macros and inlined
    > functions.

    Perhaps:

    "Introduce the source file that will contain forwarders to common C
    macros as inlined Rust functions. Initially this only contains type
    size asserts, but will gain more helpers in subsequent patches."

    >
    > Co-developed-by: Alex Gaynor <alex.gaynor@gmail.com>
    > Signed-off-by: Alex Gaynor <alex.gaynor@gmail.com>
    > Co-developed-by: Geoffrey Thomas <geofft@ldpreload.com>
    > Signed-off-by: Geoffrey Thomas <geofft@ldpreload.com>
    > Co-developed-by: Wedson Almeida Filho <wedsonaf@google.com>
    > Signed-off-by: Wedson Almeida Filho <wedsonaf@google.com>
    > Co-developed-by: Sven Van Asbroeck <thesven73@gmail.com>
    > Signed-off-by: Sven Van Asbroeck <thesven73@gmail.com>
    > Co-developed-by: Gary Guo <gary@garyguo.net>
    > Signed-off-by: Gary Guo <gary@garyguo.net>
    > Co-developed-by: Boqun Feng <boqun.feng@gmail.com>
    > Signed-off-by: Boqun Feng <boqun.feng@gmail.com>
    > Co-developed-by: Maciej Falkowski <m.falkowski@samsung.com>
    > Signed-off-by: Maciej Falkowski <m.falkowski@samsung.com>
    > Co-developed-by: Wei Liu <wei.liu@kernel.org>
    > Signed-off-by: Wei Liu <wei.liu@kernel.org>
    > Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
    > ---
    > rust/helpers.c | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
    > 1 file changed, 51 insertions(+)
    > create mode 100644 rust/helpers.c
    >
    > diff --git a/rust/helpers.c b/rust/helpers.c
    > new file mode 100644
    > index 000000000000..b4f15eee2ffd
    > --- /dev/null
    > +++ b/rust/helpers.c
    > @@ -0,0 +1,51 @@
    > +// SPDX-License-Identifier: GPL-2.0
    > +/*
    > + * Non-trivial C macros cannot be used in Rust. Similarly, inlined C functions
    > + * cannot be called either. This file explicitly creates functions ("helpers")
    > + * that wrap those so that they can be called from Rust.
    > + *
    > + * Even though Rust kernel modules should never use directly the bindings, some
    > + * of these helpers need to be exported because Rust generics and inlined
    > + * functions may not get their code generated in the crate where they are
    > + * defined. Other helpers, called from non-inline functions, may not be
    > + * exported, in principle. However, in general, the Rust compiler does not
    > + * guarantee codegen will be performed for a non-inline function either.
    > + * Therefore, this file exports all the helpers. In the future, this may be
    > + * revisited to reduce the number of exports after the compiler is informed
    > + * about the places codegen is required.
    > + *
    > + * All symbols are exported as GPL-only to guarantee no GPL-only feature is
    > + * accidentally exposed.
    > + */
    > +
    > +#include <linux/bug.h>
    > +#include <linux/build_bug.h>
    > +
    > +__noreturn void rust_helper_BUG(void)
    > +{
    > + BUG();
    > +}
    > +EXPORT_SYMBOL_GPL(rust_helper_BUG);

    Given the distaste for ever using BUG()[1], why does this helper exist?

    > +
    > +/*
    > + * We use `bindgen`'s `--size_t-is-usize` option to bind the C `size_t` type
    > + * as the Rust `usize` type, so we can use it in contexts where Rust
    > + * expects a `usize` like slice (array) indices. `usize` is defined to be
    > + * the same as C's `uintptr_t` type (can hold any pointer) but not
    > + * necessarily the same as `size_t` (can hold the size of any single
    > + * object). Most modern platforms use the same concrete integer type for
    > + * both of them, but in case we find ourselves on a platform where
    > + * that's not true, fail early instead of risking ABI or
    > + * integer-overflow issues.
    > + *
    > + * If your platform fails this assertion, it means that you are in
    > + * danger of integer-overflow bugs (even if you attempt to remove
    > + * `--size_t-is-usize`). It may be easiest to change the kernel ABI on
    > + * your platform such that `size_t` matches `uintptr_t` (i.e., to increase
    > + * `size_t`, because `uintptr_t` has to be at least as big as `size_t`).
    > + */
    > +static_assert(
    > + sizeof(size_t) == sizeof(uintptr_t) &&
    > + __alignof__(size_t) == __alignof__(uintptr_t),
    > + "Rust code expects C `size_t` to match Rust `usize`"
    > +);

    -Kees

    [1] https://docs.kernel.org/process/deprecated.html#bug-and-bug-on

    --
    Kees Cook

    \
     
     \ /
      Last update: 2022-08-17 21:46    [W:4.150 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site