Merge tag 'rust-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull rust updates from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Finish the move to custom FFI integer types started in the previous
     cycle and finally map 'long' to 'isize' and 'char' to 'u8'. Do a
     few cleanups on top thanks to that.

   - Start to use 'derive(CoercePointee)' on Rust >= 1.84.0.

     This is a major milestone on the path to build the kernel using
     only stable Rust features. In particular, previously we were using
     the unstable features 'coerce_unsized', 'dispatch_from_dyn' and
     'unsize', and now we will use the new 'derive_coerce_pointee' one,
     which is on track to stabilization. This new feature is a macro
     that essentially expands into code that internally uses the
     unstable features that we were using before, without having to
     expose those.

     With it, stable Rust users, including the kernel, will be able to
     build custom smart pointers that work with trait objects, e.g.:

         fn f(p: &Arc<dyn Display>) {
             pr_info!("{p}\n");
         }

         let a: Arc<dyn Display> = Arc::new(42i32, GFP_KERNEL)?;
         let b: Arc<dyn Display> = Arc::new("hello there", GFP_KERNEL)?;

         f(&a); // Prints "42".
         f(&b); // Prints "hello there".

     Together with the 'arbitrary_self_types' feature that we started
     using in the previous cycle, using our custom smart pointers like
     'Arc' will eventually only rely in stable Rust.

   - Introduce 'PROCMACROLDFLAGS' environment variable to allow to link
     Rust proc macros using different flags than those used for linking
     Rust host programs (e.g. when 'rustc' uses a different C library
     than the host programs' one), which Android needs.

   - Help kernel builds under macOS with Rust enabled by accomodating
     other naming conventions for dynamic libraries (i.e. '.so' vs.
     '.dylib') which are used for Rust procedural macros. The actual
     support for macOS (i.e. the rest of the pieces needed) is provided
     out-of-tree by others, following the policy used for other parts of
     the kernel by Kbuild.

   - Run Clippy for 'rusttest' code too and clean the bits it spotted.

   - Provide Clippy with the minimum supported Rust version to improve
     the suggestions it gives.

   - Document 'bindgen' 0.71.0 regression.

  'kernel' crate:

   - 'build_error!': move users of the hidden function to the documented
     macro, prevent such uses in the future by moving the function
     elsewhere and add the macro to the prelude.

   - 'types' module: add improved version of 'ForeignOwnable::borrow_mut'
     (which was removed in the past since it was problematic); change
     'ForeignOwnable' pointer type to '*mut'.

   - 'alloc' module: implement 'Display' for 'Box' and align the 'Debug'
     implementation to it; add example (doctest) for 'ArrayLayout::new()'

   - 'sync' module: document 'PhantomData' in 'Arc'; use
     'NonNull::new_unchecked' in 'ForeignOwnable for Arc' impl.

   - 'uaccess' module: accept 'Vec's with different allocators in
     'UserSliceReader::read_all'.

   - 'workqueue' module: enable run-testing a couple more doctests.

   - 'error' module: simplify 'from_errno()'.

   - 'block' module: fix formatting in code documentation (a lint to catch
     these is being implemented).

   - Avoid 'unwrap()'s in doctests, which also improves the examples by
     showing how kernel code is supposed to be written.

   - Avoid 'as' casts with 'cast{,_mut}' calls which are a bit safer.

  And a few other cleanups"

* tag 'rust-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (32 commits)
  kbuild: rust: add PROCMACROLDFLAGS
  rust: uaccess: generalize userSliceReader to support any Vec
  rust: kernel: add improved version of `ForeignOwnable::borrow_mut`
  rust: kernel: reorder `ForeignOwnable` items
  rust: kernel: change `ForeignOwnable` pointer to mut
  rust: arc: split unsafe block, add missing comment
  rust: types: avoid `as` casts
  rust: arc: use `NonNull::new_unchecked`
  rust: use derive(CoercePointee) on rustc >= 1.84.0
  rust: alloc: add doctest for `ArrayLayout::new()`
  rust: init: update `stack_try_pin_init` examples
  rust: error: import `kernel`'s `LayoutError` instead of `core`'s
  rust: str: replace unwraps with question mark operators
  rust: page: remove unnecessary helper function from doctest
  rust: rbtree: remove unwrap in asserts
  rust: init: replace unwraps with question mark operators
  rust: use host dylib naming convention to support macOS
  rust: add `build_error!` to the prelude
  rust: kernel: move `build_error` hidden function to prevent mistakes
  rust: use the `build_error!` macro, not the hidden function
  ...

1 files changed, 48 insertions, 17 deletions

diff --git a/rust/kernel/sync/arc.rs b/rust/kernel/sync/arc.rs
index fa4509406ee9..3cefda7a4372 100644
--- a/rust/kernel/sync/arc.rs
+++ b/rust/kernel/sync/arc.rs
@@ -26,7 +26,7 @@ use crate::{
 use core::{
     alloc::Layout,
     fmt,
-    marker::{PhantomData, Unsize},
+    marker::PhantomData,
     mem::{ManuallyDrop, MaybeUninit},
     ops::{Deref, DerefMut},
     pin::Pin,
@@ -125,8 +125,18 @@ mod std_vendor;
 /// let coerced: Arc<dyn MyTrait> = obj;
 /// # Ok::<(), Error>(())
 /// ```
+#[repr(transparent)]
+#[cfg_attr(CONFIG_RUSTC_HAS_COERCE_POINTEE, derive(core::marker::CoercePointee))]
 pub struct Arc<T: ?Sized> {
     ptr: NonNull<ArcInner<T>>,
+    // NB: this informs dropck that objects of type `ArcInner<T>` may be used in `<Arc<T> as
+    // Drop>::drop`. Note that dropck already assumes that objects of type `T` may be used in
+    // `<Arc<T> as Drop>::drop` and the distinction between `T` and `ArcInner<T>` is not presently
+    // meaningful with respect to dropck - but this may change in the future so this is left here
+    // out of an abundance of caution.
+    //
+    // See https://doc.rust-lang.org/nomicon/phantom-data.html#generic-parameters-and-drop-checking
+    // for more detail on the semantics of dropck in the presence of `PhantomData`.
     _p: PhantomData<ArcInner<T>>,
 }
 
@@ -172,10 +182,12 @@ impl<T: ?Sized> ArcInner<T> {
 
 // This is to allow coercion from `Arc<T>` to `Arc<U>` if `T` can be converted to the
 // dynamically-sized type (DST) `U`.
-impl<T: ?Sized + Unsize<U>, U: ?Sized> core::ops::CoerceUnsized<Arc<U>> for Arc<T> {}
+#[cfg(not(CONFIG_RUSTC_HAS_COERCE_POINTEE))]
+impl<T: ?Sized + core::marker::Unsize<U>, U: ?Sized> core::ops::CoerceUnsized<Arc<U>> for Arc<T> {}
 
 // This is to allow `Arc<U>` to be dispatched on when `Arc<T>` can be coerced into `Arc<U>`.
-impl<T: ?Sized + Unsize<U>, U: ?Sized> core::ops::DispatchFromDyn<Arc<U>> for Arc<T> {}
+#[cfg(not(CONFIG_RUSTC_HAS_COERCE_POINTEE))]
+impl<T: ?Sized + core::marker::Unsize<U>, U: ?Sized> core::ops::DispatchFromDyn<Arc<U>> for Arc<T> {}
 
 // SAFETY: It is safe to send `Arc<T>` to another thread when the underlying `T` is `Sync` because
 // it effectively means sharing `&T` (which is safe because `T` is `Sync`); additionally, it needs
@@ -201,10 +213,11 @@ impl<T> Arc<T> {
         };
 
         let inner = KBox::new(value, flags)?;
+        let inner = KBox::leak(inner).into();
 
         // SAFETY: We just created `inner` with a reference count of 1, which is owned by the new
         // `Arc` object.
-        Ok(unsafe { Self::from_inner(KBox::leak(inner).into()) })
+        Ok(unsafe { Self::from_inner(inner) })
     }
 }
 
@@ -331,26 +344,37 @@ impl<T: ?Sized> Arc<T> {
 
 impl<T: 'static> ForeignOwnable for Arc<T> {
     type Borrowed<'a> = ArcBorrow<'a, T>;
+    type BorrowedMut<'a> = Self::Borrowed<'a>;
 
-    fn into_foreign(self) -> *const crate::ffi::c_void {
-        ManuallyDrop::new(self).ptr.as_ptr() as _
+    fn into_foreign(self) -> *mut crate::ffi::c_void {
+        ManuallyDrop::new(self).ptr.as_ptr().cast()
     }
 
-    unsafe fn borrow<'a>(ptr: *const crate::ffi::c_void) -> ArcBorrow<'a, T> {
-        // By the safety requirement of this function, we know that `ptr` came from
-        // a previous call to `Arc::into_foreign`.
-        let inner = NonNull::new(ptr as *mut ArcInner<T>).unwrap();
+    unsafe fn from_foreign(ptr: *mut crate::ffi::c_void) -> Self {
+        // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
+        // call to `Self::into_foreign`.
+        let inner = unsafe { NonNull::new_unchecked(ptr.cast::<ArcInner<T>>()) };
+
+        // SAFETY: By the safety requirement of this function, we know that `ptr` came from
+        // a previous call to `Arc::into_foreign`, which guarantees that `ptr` is valid and
+        // holds a reference count increment that is transferrable to us.
+        unsafe { Self::from_inner(inner) }
+    }
+
+    unsafe fn borrow<'a>(ptr: *mut crate::ffi::c_void) -> ArcBorrow<'a, T> {
+        // SAFETY: The safety requirements of this function ensure that `ptr` comes from a previous
+        // call to `Self::into_foreign`.
+        let inner = unsafe { NonNull::new_unchecked(ptr.cast::<ArcInner<T>>()) };
 
         // SAFETY: The safety requirements of `from_foreign` ensure that the object remains alive
         // for the lifetime of the returned value.
         unsafe { ArcBorrow::new(inner) }
     }
 
-    unsafe fn from_foreign(ptr: *const crate::ffi::c_void) -> Self {
-        // SAFETY: By the safety requirement of this function, we know that `ptr` came from
-        // a previous call to `Arc::into_foreign`, which guarantees that `ptr` is valid and
-        // holds a reference count increment that is transferrable to us.
-        unsafe { Self::from_inner(NonNull::new(ptr as _).unwrap()) }
+    unsafe fn borrow_mut<'a>(ptr: *mut crate::ffi::c_void) -> ArcBorrow<'a, T> {
+        // SAFETY: The safety requirements for `borrow_mut` are a superset of the safety
+        // requirements for `borrow`.
+        unsafe { Self::borrow(ptr) }
     }
 }
 
@@ -372,10 +396,14 @@ impl<T: ?Sized> AsRef<T> for Arc<T> {
 
 impl<T: ?Sized> Clone for Arc<T> {
     fn clone(&self) -> Self {
+        // SAFETY: By the type invariant, there is necessarily a reference to the object, so it is
+        // safe to dereference it.
+        let refcount = unsafe { self.ptr.as_ref() }.refcount.get();
+
         // INVARIANT: C `refcount_inc` saturates the refcount, so it cannot overflow to zero.
         // SAFETY: By the type invariant, there is necessarily a reference to the object, so it is
         // safe to increment the refcount.
-        unsafe { bindings::refcount_inc(self.ptr.as_ref().refcount.get()) };
+        unsafe { bindings::refcount_inc(refcount) };
 
         // SAFETY: We just incremented the refcount. This increment is now owned by the new `Arc`.
         unsafe { Self::from_inner(self.ptr) }
@@ -471,6 +499,8 @@ impl<T: ?Sized> From<Pin<UniqueArc<T>>> for Arc<T> {
 /// obj.as_arc_borrow().use_reference();
 /// # Ok::<(), Error>(())
 /// ```
+#[repr(transparent)]
+#[cfg_attr(CONFIG_RUSTC_HAS_COERCE_POINTEE, derive(core::marker::CoercePointee))]
 pub struct ArcBorrow<'a, T: ?Sized + 'a> {
     inner: NonNull<ArcInner<T>>,
     _p: PhantomData<&'a ()>,
@@ -478,7 +508,8 @@ pub struct ArcBorrow<'a, T: ?Sized + 'a> {
 
 // This is to allow `ArcBorrow<U>` to be dispatched on when `ArcBorrow<T>` can be coerced into
 // `ArcBorrow<U>`.
-impl<T: ?Sized + Unsize<U>, U: ?Sized> core::ops::DispatchFromDyn<ArcBorrow<'_, U>>
+#[cfg(not(CONFIG_RUSTC_HAS_COERCE_POINTEE))]
+impl<T: ?Sized + core::marker::Unsize<U>, U: ?Sized> core::ops::DispatchFromDyn<ArcBorrow<'_, U>>
     for ArcBorrow<'_, T>
 {
 }