summaryrefslogtreecommitdiff
path: root/rust/kernel/id_pool.rs
AgeCommit message (Collapse)Author
2 daysMerge tag 'rust-7.4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Update vendored 'zerocopy' crate to v0.8.62 (released 2026-10-08). This update advances 8 releases, with 3 of them carrying most of the changes. It contains new features as well as fixes. However, almost nothing has changed that requires updates on our side (a move of our non-ASCII change and the addition of an SPDX license identifier). - Generate Rust KUnit test suites for doctests reusing the '#[kunit_tests]' and '#[test]' attributes instead of C FFI functions, which allows to remove the generated C glue file. Relatedly, simplify 'kunit_assert!' by using 'file!()' and 'line!()' inside (which doctests override as needed), which allows to remove the 'file' helper and 'CONFIG_RUSTC_HAS_SPAN_FILE'. - Trim the function names in doctests generated by 'rustdoc' < 1.95.0 when building with 'O=', which were not reproducible. - Fix the 'VM_MAYSHARE' value in the generated bindings and its blocklist entry, due to typos. - Build 'core' with '--cfg no_io_statics' to ensure 'core' does not introduce any use of 'core::sync::atomic' into the kernel image since upstream Rust is moving 'std::io::Error' into 'core', which uses a global atomic pointer. Upstream Rust merged a PR to add a test checking that builds of 'core' are warning-free with that 'cfg' enabled. - Enable the unstable 'proc_macro_span' feature in 'proc-macro2', which provides 'Span::join' and thus improves the quality of the diagnostics of all our procedural macros, notably 'pin-init'. This is only used for producing diagnostics, thus there is no hard reliance on the feature. - Globally allow 'clippy::comparison_chain', since its suggestions are not always ideal and upstream downgraded it to 'pedantic' too. 'kernel' crate: - New 'mem' module: add the 'Align<N>' zero-sized type so that alignment can be specified via const generics ('repr(align(...))' only works with integer literals), e.g.: const N: usize = 128; struct S { _align: Align<N>, } assert_eq!(align_of::<S>(), N); - New 'ratelimit' module: add the 'Ratelimit' abstraction for 'struct ratelimit_state' and, based on it, the 'pr_*_ratelimited!' printing macros, which can be used for printing that may be triggered by userspace. In addition, convert Rust Binder to use them. - 'sync' module: to construct a global 'struct ratelimit_state', add a 'const' constructor for 'raw_spinlock_t'. In addition, move the lockdep types into a new 'sync::lockdep' submodule, since there were starting to be too many of them. - 'num' module: add the 'cv!' macro to create constant values ("cv") from an integer constant expression, with validity checked at compile time, inferring the target type from the context. It works for any type that implements the new 'FromConst' trait, e.g.: let a: Alignment = cv!(4096); let b: Bounded<u32, 4> = cv!(15); // Any integer constant expression works, not only literals. let m: NonZero<usize> = cv!(usize::MAX); // Checked narrowing, including in `const` items. const SMALL: u8 = cv!(200u32); // The target type can be given explicitly. let e = cv!(200u32 => u8); // With an explicit primitive target, the expression can use // generic parameters. const fn as_u64<const KEY: u16>() -> u64 { cv!(KEY => u64) } This avoids the verbose turbofish syntax which disincentivized using these types at interface boundaries (e.g. 'Alignment::new::<8>()'). - 'alloc' module: - Allow different error types in 'KBox::pin_slice()', enabling use of infallible initializers. - Add 'NumaNode::id()' accessor to retrieve the underlying NUMA node identifier. - 'time' module: - Add 'Delta::to_jiffies_timeout()' for use in timeout arguments. - Add 'Delta::as_jiffies_unsigned()'. - Make 'Delta::ZERO' generic over the time unit. - Warn and assert when passing out-of-range inputs to 'fsleep' and 'udelay'. - Rename 'ClockSource' to 'ClockId' to better align with naming conventions in C kernel. - Make 'CONFIG_HZ' value available as 'bindings::HZ'. - Add implementation detail documentation for 'HrTimer'. - 'bitmap' module: - Add contiguous area operations ('next_zero_area{,_off}', 'set' and 'clear'), with extra checks compared to the underlying C code, plus additional ones under 'CONFIG_RUST_BITMAP_HARDENED'. It includes tests demonstrating the edge cases. - Restrict bitmap length to at most 'i32::MAX', matching 'BitmapVec::MAX_LEN' and simplifying a few things. This also fixes 'u32' casts truncating in 'copy_and_extend', which could otherwise lead to OOB writes. - 'bug' module: - Fix 'warn_on!' on UML which called 'warn_slowpath_fmt()' with the wrong arguments; and fix its '// SAFETY:' comment too. - Add a KUnit test for 'warn_on!'. - 'id_pool' module: add contiguous ID reservation via the new 'reserve_ids' and 'release_ids' methods, built on top of the new bitmap area operations. - 'sizes' module: add the sub-1K size constants ('SZ_1' to 'SZ_512') and implement 'SizeConstants' for 'Alignment', so that one can write e.g. 'Alignment::SZ_8'. 'macros' crate: - Add '#[optional]' attribute for optional methods in '#[vtable]' to replace the 'build_error!(VTABLE_DEFAULT_ERROR)' boilerplate, e.g.: #[vtable] pub trait Operations: Sized { #[optional] fn f(&self) -> Result; } In addition, apply it to miscdevice and hide generated 'HAS_' constants for required methods. - Allow non-ASCII characters in the 'authors' field of the 'module!' macro, which was unintentionally restricted when multiple authors support was introduced. 'pin-init' crate: [ Extra context from Gary's pull request: "This is a cycle packed with feature updates. Two of the most anticipated features, tuple struct support and safe self reference creation, has been included in this pull request. Safe self reference is a big one and is pushed a bit late in the cycle. The initial plan was to include a minimum subset for this cycle because I was worried about potential soundness issues; however during Plumbers it was agreed that the features should be upstreamed at once. This is because the initial users (Nova, JobQueue) would all need the advanced features, so it is better to ensure that the feature get put into use for real, and it can iterate with users, rather than being fully designed on paper. The existing safety checks are already very comprehensive, and Benno and I are confident that if new ones are discovered, it wouldn't affect the overall design. That said, the the usage of the advanced features (invariance, existential lifetime) shall be limited to the pre-agreed users only, so even in case where the feature needs to be reworked, the blast radius is limited. Another theme in this cycle is to improve the developer experience when things are used wrongly. A lot of work has been done to use proper spans from user-provided tokens so error message point to things that cause them. Many common misuse scenarios also gain additional custom diagnostics." ] - User visible changes: - Support tuple structs. - Allow safe creation of self references. - Vastly improve diagnostics for common misuse scenarios. - Other changes: - Use 'mixed_site' hygiene consistently. 'MAINTAINERS': - Add 'RUST [BUG]' entry for the Rust 'bug' module (i.e. 'warn_on!'), which will be maintained by FUJITA Tomonori -- thank you! - Add Alice Ryhl as co-maintainer for 'Rust [ALLOC]'. And some other fixes, cleanups and improvements. * tag 'rust-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (91 commits) rust: zerocopy: update to v0.8.62 rust: zerocopy: fix link to upstream `README.md` rust: id_pool: add contiguous ID reservation rust: bitmap: add contiguous area operations rust: sizes: implement SizeConstants for Alignment rust: sizes: add sub-1K size constants rust: bitmap: restrict bitmap length to at most i32::MAX rust: bitmap: use function-level cfg on kunit test rust: num: add cv! macro to create values from constant expressions rust: bug: update the SAFETY comment for warn_slowpath_fmt() on UML rust: time: add Delta::as_jiffies_unsigned() rust: time: make Delta::ZERO generic over the time unit rust_binder: use pr_*_ratelimited! for printing rust: add pr_*_ratelimited! macros for printing rust: sync: add const constructor for raw_spinlock_t rust: sync: move lockdep types to rust/kernel/sync/lockdep.rs rust: pin-init: internal: suppress `explicit_outlives_requirements` MAINTAINERS: add entry for the Rust `bug` module rust: pin-init: internal: pin_data: support existential lifetimes rust: pin-init: internal: pin_data: support shared projection ...
11 daysrust: id_pool: add contiguous ID reservationEliot Courtney
Add `IdPool::reserve_ids` which allocates a contiguous range with the given offset, count, and alignment. Reviewed-by: Burak Emir <burak.emir@gmail.com> Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com> Reviewed-by: Yury Norov <ynorov@nvidia.com> Link: https://patch.msgid.link/20260930-chid-v9-7-0d6cca376cff@nvidia.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
2026-10-06rust: id_pool: document panics in `find_unused_id` and `release_id`Georgios Androutsopoulos
`find_unused_id()` calls `Bitmap::next_zero_bit()` and `release_id()` calls `Bitmap::clear_bit()`, both of which panic when `CONFIG_RUST_BITMAP_HARDENED` is enabled and the index is out of bounds. Neither `IdPool` method documents this. Add the missing `# Panics` sections and state the bounds requirement on `offset` and `id`. Fixes: 2cdae413cd3e ("rust: add dynamic ID pool abstraction for bitmap") Reviewed-by: Alexandre Courbot <acourbot@nvidia.com> Signed-off-by: Georgios Androutsopoulos <georgeandrout13@gmail.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2025-12-02rust: id_pool: do not immediately acquire new idsAlice Ryhl
When Rust Binder assigns a new ID, it performs various fallible operations before it "commits" to actually using the new ID. To support this pattern, change acquire_next_id() so that it does not immediately call set_bit(), but instead returns an object that may be used to call set_bit() later. The UnusedId type holds a exclusive reference to the IdPool, so it's guaranteed that nobody else can call find_unused_id() while the UnusedId object is live. [Miguel: rust: id_pool: fix example] Reviewed-by: Burak Emir <bqe@google.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
2025-12-02rust: id_pool: do not supply starting capacityAlice Ryhl
Rust Binder wants to use inline bitmaps whenever possible to avoid allocations, so introduce a constructor for an IdPool with arbitrary capacity that stores the bitmap inline. The existing constructor could be renamed to with_capacity() to match constructors for other similar types, but it is removed as there is currently no user for it. [Miguel: rust: id_pool: fix broken intra-doc link] Acked-by: Yury Norov (NVIDIA) <yury.norov@gmail.com> Reviewed-by: Burak Emir <bqe@google.com> Reviewed-by: Danilo Krummrich <dakr@kernel.org> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
2025-11-26rust: id_pool: rename IdPool::new() to with_capacity()Alice Ryhl
We want to change ::new() to take no parameters and produce a pool that is as large as possible while also being inline because that is the constructor that Rust Binder actually needs. However, to avoid complications in examples, we still need the current constructor. So rename it to with_capacity(), which is the idiomatic Rust name for this kind constructor. Reviewed-by: Burak Emir <bqe@google.com> Signed-off-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
2025-11-26rust: bitmap: add MAX_LEN and MAX_INLINE_LEN constantsAlice Ryhl
To avoid hard-coding these values in drivers, define constants for them that drivers can reference. Also, update all instances in bitmap.rs and id_pool.rs that use these values to use the new constants. Signed-off-by: Alice Ryhl <aliceryhl@google.com> Reviewed-by: Burak Emir <bqe@google.com> Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
2025-09-22rust: add dynamic ID pool abstraction for bitmapBurak Emir
This is a port of the Binder data structure introduced in commit 15d9da3f818c ("binder: use bitmap for faster descriptor lookup") to Rust. Like drivers/android/dbitmap.h, the ID pool abstraction lets clients acquire and release IDs. The implementation uses a bitmap to know what IDs are in use, and gives clients fine-grained control over the time of allocation. This fine-grained control is needed in the Android Binder. We provide an example that release a spinlock for allocation and unit tests (rustdoc examples). The implementation does not permit shrinking below capacity below BITS_PER_LONG. Suggested-by: Alice Ryhl <aliceryhl@google.com> Suggested-by: Yury Norov <yury.norov@gmail.com> Reviewed-by: Alice Ryhl <aliceryhl@google.com> Signed-off-by: Burak Emir <bqe@google.com> Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>