rust: enable `clippy::ref_as_ptr` lintIn Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]:> Using `as` casts may result in silently changing mutability or type.While this doesn't elimin
rust: enable `clippy::ref_as_ptr` lintIn Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]:> Using `as` casts may result in silently changing mutability or type.While this doesn't eliminate unchecked `as` conversions, it makes suchconversions easier to scrutinize. It also has the slight benefit ofremoving a degree of freedom on which to bikeshed. Thus apply thechanges and enable the lint -- no functional change intended.Link: https://rust-lang.github.io/rust-clippy/master/index.html#ref_as_ptr [1]Suggested-by: Benno Lossin <benno.lossin@proton.me>Link: https://lore.kernel.org/all/D8PGG7NTWB6U.3SS3A5LN4XWMN@proton.me/Reviewed-by: Benno Lossin <benno.lossin@proton.me>Reviewed-by: Boqun Feng <boqun.feng@gmail.com>Signed-off-by: Tamir Duberstein <tamird@gmail.com>Acked-by: Danilo Krummrich <dakr@kernel.org>Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-6-f43b024581e8@gmail.comSigned-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
rust: enable `clippy::ptr_as_ptr` lintIn Rust 1.51.0, Clippy introduced the `ptr_as_ptr` lint [1]:> Though `as` casts between raw pointers are not terrible,> `pointer::cast` is safer because it
rust: enable `clippy::ptr_as_ptr` lintIn Rust 1.51.0, Clippy introduced the `ptr_as_ptr` lint [1]:> Though `as` casts between raw pointers are not terrible,> `pointer::cast` is safer because it cannot accidentally change the> pointer's mutability, nor cast the pointer to other types like `usize`.There are a few classes of changes required:- Modules generated by bindgen are marked `#[allow(clippy::ptr_as_ptr)]`.- Inferred casts (` as _`) are replaced with `.cast()`.- Ascribed casts (` as *... T`) are replaced with `.cast::<T>()`.- Multistep casts from references (` as *const _ as *const T`) are replaced with `core::ptr::from_ref(&x).cast()` with or without `::<T>` according to the previous rules. The `core::ptr::from_ref` call is required because `(x as *const _).cast::<T>()` results in inference failure.- Native literal C strings are replaced with `c_str!().as_char_ptr()`.- `*mut *mut T as _` is replaced with `let *mut *const T = (*mut *mut T)`.cast();` since pointer to pointer can be confusing.Apply these changes and enable the lint -- no functional changeintended.Link: https://rust-lang.github.io/rust-clippy/master/index.html#ptr_as_ptr [1]Reviewed-by: Benno Lossin <benno.lossin@proton.me>Reviewed-by: Boqun Feng <boqun.feng@gmail.com>Signed-off-by: Tamir Duberstein <tamird@gmail.com>Acked-by: Viresh Kumar <viresh.kumar@linaro.org>Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>Acked-by: Tejun Heo <tj@kernel.org>Acked-by: Danilo Krummrich <dakr@kernel.org>Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-1-f43b024581e8@gmail.com[ Added `.cast()` for `opp`. - Miguel ]Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
rust: file: improve safety commentsSome of the safety comments in `LocalFile`'s methods incorrectly refer tothe `File` type instead of `LocalFile`, so fix them to use the correcttype.Also add m
rust: file: improve safety commentsSome of the safety comments in `LocalFile`'s methods incorrectly refer tothe `File` type instead of `LocalFile`, so fix them to use the correcttype.Also add missing Markdown code spans around lifetimes in the safetycomments, i.e. change 'a to `'a`.Link: https://github.com/Rust-for-Linux/linux/issues/1165Signed-off-by: Pekka Ristola <pekkarr@protonmail.com>Link: https://lore.kernel.org/20250527204636.12573-2-pekkarr@protonmail.comReviewed-by: Benno Lossin <lossin@kernel.org>Reviewed-by: Alice Ryhl <aliceryhl@google.com>Signed-off-by: Christian Brauner <brauner@kernel.org>
rust: file: mark `LocalFile` as `repr(transparent)`Unsafe code in `LocalFile`'s methods assumes that the type has the samelayout as the inner `bindings::file`. This is not guaranteed by the defaul
rust: file: mark `LocalFile` as `repr(transparent)`Unsafe code in `LocalFile`'s methods assumes that the type has the samelayout as the inner `bindings::file`. This is not guaranteed by the defaultstruct representation in Rust, but requires specifying the `transparent`representation.The `File` struct (which also wraps `bindings::file`) is already marked as`repr(transparent)`, so this change makes their layouts equivalent.Fixes: 851849824bb5 ("rust: file: add Rust abstraction for `struct file`")Closes: https://github.com/Rust-for-Linux/linux/issues/1165Signed-off-by: Pekka Ristola <pekkarr@protonmail.com>Link: https://lore.kernel.org/20250527204636.12573-1-pekkarr@protonmail.comReviewed-by: Benno Lossin <lossin@kernel.org>Reviewed-by: Alice Ryhl <aliceryhl@google.com>Signed-off-by: Christian Brauner <brauner@kernel.org>
Merge tag 'rust-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linuxPull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Extract the 'pin-init' API from the 'ker
Merge tag 'rust-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linuxPull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Extract the 'pin-init' API from the 'kernel' crate and make it into a standalone crate. In order to do this, the contents are rearranged so that they can easily be kept in sync with the version maintained out-of-tree that other projects have started to use too (or plan to, like QEMU). This will reduce the maintenance burden for Benno, who will now have his own sub-tree, and will simplify future expected changes like the move to use 'syn' to simplify the implementation. - Add '#[test]'-like support based on KUnit. We already had doctests support based on KUnit, which takes the examples in our Rust documentation and runs them under KUnit. Now, we are adding the beginning of the support for "normal" tests, similar to those the '#[test]' tests in userspace Rust. For instance: #[kunit_tests(my_suite)] mod tests { #[test] fn my_test() { assert_eq!(1 + 1, 2); } } Unlike with doctests, the 'assert*!'s do not map to the KUnit assertion APIs yet. - Check Rust signatures at compile time for functions called from C by name. In particular, introduce a new '#[export]' macro that can be placed in the Rust function definition. It will ensure that the function declaration on the C side matches the signature on the Rust function: #[export] pub unsafe extern "C" fn my_function(a: u8, b: i32) -> usize { // ... } The macro essentially forces the compiler to compare the types of the actual Rust function and the 'bindgen'-processed C signature. These cases are rare so far. In the future, we may consider introducing another tool, 'cbindgen', to generate C headers automatically. Even then, having these functions explicitly marked may be a good idea anyway. - Enable the 'raw_ref_op' Rust feature: it is already stable, and allows us to use the new '&raw' syntax, avoiding a couple macros. After everyone has migrated, we will disallow the macros. - Pass the correct target to 'bindgen' on Usermode Linux. - Fix 'rusttest' build in macOS. 'kernel' crate: - New 'hrtimer' module: add support for setting up intrusive timers without allocating when starting the timer. Add support for 'Pin<Box<_>>', 'Arc<_>', 'Pin<&_>' and 'Pin<&mut _>' as pointer types for use with timer callbacks. Add support for setting clock source and timer mode. - New 'dma' module: add a simple DMA coherent allocator abstraction and a test sample driver. - 'list' module: make the linked list 'Cursor' point between elements, rather than at an element, which is more convenient to us and allows for cursors to empty lists; and document it with examples of how to perform common operations with the provided methods. - 'str' module: implement a few traits for 'BStr' as well as the 'strip_prefix()' method. - 'sync' module: add 'Arc::as_ptr'. - 'alloc' module: add 'Box::into_pin'. - 'error' module: extend the 'Result' documentation, including a few examples on different ways of handling errors, a warning about using methods that may panic, and links to external documentation. 'macros' crate: - 'module' macro: add the 'authors' key to support multiple authors. The original key will be kept until everyone has migrated. Documentation: - Add error handling sections. MAINTAINERS: - Add Danilo Krummrich as reviewer of the Rust "subsystem". - Add 'RUST [PIN-INIT]' entry with Benno Lossin as maintainer. It has its own sub-tree. - Add sub-tree for 'RUST [ALLOC]'. - Add 'DMA MAPPING HELPERS DEVICE DRIVER API [RUST]' entry with Abdiel Janulgue as primary maintainer. It will go through the sub-tree of the 'RUST [ALLOC]' entry. - Add 'HIGH-RESOLUTION TIMERS [RUST]' entry with Andreas Hindborg as maintainer. It has its own sub-tree. And a few other cleanups and improvements"* tag 'rust-6.15' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (71 commits) rust: dma: add `Send` implementation for `CoherentAllocation` rust: macros: fix `make rusttest` build on macOS rust: block: refactor to use `&raw mut` rust: enable `raw_ref_op` feature rust: uaccess: name the correct function rust: rbtree: fix comments referring to Box instead of KBox rust: hrtimer: add maintainer entry rust: hrtimer: add clocksource selection through `ClockId` rust: hrtimer: add `HrTimerMode` rust: hrtimer: implement `HrTimerPointer` for `Pin<Box<T>>` rust: alloc: add `Box::into_pin` rust: hrtimer: implement `UnsafeHrTimerPointer` for `Pin<&mut T>` rust: hrtimer: implement `UnsafeHrTimerPointer` for `Pin<&T>` rust: hrtimer: add `hrtimer::ScopedHrTimerPointer` rust: hrtimer: add `UnsafeHrTimerPointer` rust: hrtimer: allow timer restart from timer handler rust: str: implement `strip_prefix` for `BStr` rust: str: implement `AsRef<BStr>` for `[u8]` and `BStr` rust: str: implement `Index` for `BStr` rust: str: implement `PartialEq` for `BStr` ...
rust: file: optimize rust symbol generation for FileDescriptorReservationWhen build the kernel using the llvm-18.1.3-rust-1.85.0-x86_64with ARCH=arm64, the following symbols are generated:$ nm v
rust: file: optimize rust symbol generation for FileDescriptorReservationWhen build the kernel using the llvm-18.1.3-rust-1.85.0-x86_64with ARCH=arm64, the following symbols are generated:$ nm vmlinux | grep ' _R'.*FileDescriptorReservation | rustfilt... T <kernel::fs::file::FileDescriptorReservation>::fd_install... T <kernel::fs::file::FileDescriptorReservation>::get_unused_fd_flags... T <kernel::fs::file::FileDescriptorReservation as core::ops::drop::Drop>::dropThese Rust symbols are trivial wrappers around the C functionsfd_install, put_unused_fd and put_task_struct. Itdoesn't make sense to go through a trivial wrapper for thesefunctions, so mark them inline.Link: https://github.com/Rust-for-Linux/linux/issues/1145Suggested-by: Alice Ryhl <aliceryhl@google.com>Co-developed-by: Grace Deng <Grace.Deng006@Gmail.com>Signed-off-by: Grace Deng <Grace.Deng006@Gmail.com>Signed-off-by: Kunwu Chan <kunwu.chan@hotmail.com>Link: https://lore.kernel.org/r/20250317023702.2360726-1-kunwu.chan@linux.devReviewed-by: Alice Ryhl <aliceryhl@google.com>Signed-off-by: Christian Brauner <brauner@kernel.org>
rust: improve lifetimes markupImprove lifetimes markup; e.g. from: /// ... 'a ...to: /// ... `'a` ...This will make lifetimes display as code span with Markdown and make itmore consi
rust: improve lifetimes markupImprove lifetimes markup; e.g. from: /// ... 'a ...to: /// ... `'a` ...This will make lifetimes display as code span with Markdown and make itmore consistent with rest of the docs.Link: https://github.com/Rust-for-Linux/linux/issues/1138Signed-off-by: Borys Tyran <borys.tyran@protonmail.com>Link: https://lore.kernel.org/r/20250207142437.112435-1-borys.tyran@protonmail.com[ Reworded and changed Closes tag to Link. - Miguel ]Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
rust: file: add `FileDescriptorReservation`Allow for the creation of a file descriptor in two steps: first, wereserve a slot for it, then we commit or drop the reservation. The firststep may fail
rust: file: add `FileDescriptorReservation`Allow for the creation of a file descriptor in two steps: first, wereserve a slot for it, then we commit or drop the reservation. The firststep may fail (e.g., the current process ran out of available slots),but commit and drop never fail (and are mutually exclusive).This is needed by Rust Binder when fds are sent from one process toanother. It has to be a two-step process to properly handle the casewhere multiple fds are sent: The operation must fail or succeedatomically, which we achieve by first reserving the fds we need, andonly installing the files once we have reserved enough fds to send thefiles.Fd reservations assume that the value of `current` does not changebetween the call to get_unused_fd_flags and the call to fd_install (orput_unused_fd). By not implementing the Send trait, this abstractionensures that the `FileDescriptorReservation` cannot be moved into adifferent process.Signed-off-by: Wedson Almeida Filho <wedsonaf@gmail.com>Co-developed-by: Alice Ryhl <aliceryhl@google.com>Reviewed-by: Benno Lossin <benno.lossin@proton.me>Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com>Reviewed-by: Trevor Gross <tmgross@umich.edu>Reviewed-by: Gary Guo <gary@garyguo.net>Signed-off-by: Alice Ryhl <aliceryhl@google.com>Link: https://lore.kernel.org/r/20240915-alice-file-v10-6-88484f7a3dcf@google.comSigned-off-by: Christian Brauner <brauner@kernel.org>
rust: cred: add Rust abstraction for `struct cred`Add a wrapper around `struct cred` called `Credential`, and providefunctionality to get the `Credential` associated with a `File`.Rust Binder mu
rust: cred: add Rust abstraction for `struct cred`Add a wrapper around `struct cred` called `Credential`, and providefunctionality to get the `Credential` associated with a `File`.Rust Binder must check the credentials of processes when they attempt toperform various operations, and these checks usually take a`&Credential` as parameter. The security_binder_set_context_mgr functionwould be one example. This patch is necessary to access these security_*methods from Rust.This Rust abstraction makes the following assumptions about the C side:* `struct cred` is refcounted with `get_cred`/`put_cred`.* It's okay to transfer a `struct cred` across threads, that is, you do not need to call `put_cred` on the same thread as where you called `get_cred`.* The `euid` field of a `struct cred` never changes after initialization.* The `f_cred` field of a `struct file` never changes after initialization.Signed-off-by: Wedson Almeida Filho <wedsonaf@gmail.com>Co-developed-by: Alice Ryhl <aliceryhl@google.com>Reviewed-by: Trevor Gross <tmgross@umich.edu>Reviewed-by: Benno Lossin <benno.lossin@proton.me>Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com>Reviewed-by: Gary Guo <gary@garyguo.net>Signed-off-by: Alice Ryhl <aliceryhl@google.com>Link: https://lore.kernel.org/r/20240915-alice-file-v10-4-88484f7a3dcf@google.comReviewed-by: Kees Cook <kees@kernel.org>Reviewed-by: Paul Moore <paul@paul-moore.com>Signed-off-by: Christian Brauner <brauner@kernel.org>
rust: file: add Rust abstraction for `struct file`This abstraction makes it possible to manipulate the open files for aprocess. The new `File` struct wraps the C `struct file`. When accessingit u
rust: file: add Rust abstraction for `struct file`This abstraction makes it possible to manipulate the open files for aprocess. The new `File` struct wraps the C `struct file`. When accessingit using the smart pointer `ARef<File>`, the pointer will own areference count to the file. When accessing it as `&File`, then thereference does not own a refcount, but the borrow checker will ensurethat the reference count does not hit zero while the `&File` is live.Since this is intended to manipulate the open files of a process, weintroduce an `fget` constructor that corresponds to the C `fget`method. In future patches, it will become possible to create a new fd ina process and bind it to a `File`. Rust Binder will use these to sendfds from one process to another.We also provide a method for accessing the file's flags. Rust Binderwill use this to access the flags of the Binder fd to check whether thenon-blocking flag is set, which affects what the Binder ioctl does.This introduces a struct for the EBADF error type, rather than justusing the Error type directly. This has two advantages:* `File::fget` returns a `Result<ARef<File>, BadFdError>`, which the compiler will represent as a single pointer, with null being an error. This is possible because the compiler understands that `BadFdError` has only one possible value, and it also understands that the `ARef<File>` smart pointer is guaranteed non-null.* Additionally, we promise to users of the method that the method can only fail with EBADF, which means that they can rely on this promise without having to inspect its implementation.That said, there are also two disadvantages:* Defining additional error types involves boilerplate.* The question mark operator will only utilize the `From` trait once, which prevents you from using the question mark operator on `BadFdError` in methods that return some third error type that the kernel `Error` is convertible into. (However, it works fine in methods that return `Error`.)Signed-off-by: Wedson Almeida Filho <wedsonaf@gmail.com>Co-developed-by: Daniel Xu <dxu@dxuuu.xyz>Signed-off-by: Daniel Xu <dxu@dxuuu.xyz>Co-developed-by: Alice Ryhl <aliceryhl@google.com>Reviewed-by: Benno Lossin <benno.lossin@proton.me>Signed-off-by: Alice Ryhl <aliceryhl@google.com>Link: https://lore.kernel.org/r/20240915-alice-file-v10-3-88484f7a3dcf@google.comReviewed-by: Gary Guo <gary@garyguo.net>Signed-off-by: Christian Brauner <brauner@kernel.org>