Re: [PATCH v6] rust: transmute: Add methods for FromBytes trait
From: Matthew Maurer
Date: Wed Apr 09 2025 - 18:33:15 EST
On Sun, Mar 30, 2025 at 4:40 PM Christian S. Lima
<christiansantoslima21@xxxxxxxxx> wrote:
>
> Methods receive a slice and perform size check to add a valid way to make
> conversion safe. An Option is used, in error case just return `None`.
>
> The conversion between slices `[T]` is separated from others, because I
> couldn't implement it in the same way as the other conversions.
>
> Link: https://github.com/Rust-for-Linux/linux/issues/1119
> Signed-off-by: Christian S. Lima <christiansantoslima21@xxxxxxxxx>
> ---
> Changes in v2:
> - Rollback the implementation for the macro in the repository and implement
> methods in trait
> - Link to v2: https://lore.kernel.org/rust-for-linux/20241012193657.290cc79c@eugeo/T/#t
>
> Changes in v3:
> - Fix grammar errors
> - Remove repeated tests
> - Fix alignment errors
> - Fix tests not building
> - Link to v3: https://lore.kernel.org/rust-for-linux/20241109055442.85190-1-christiansantoslima21@xxxxxxxxx/
>
> Changes in v4:
> - Removed core::simd::ToBytes
> - Changed trait and methods to safe Add
> - Result<&Self, Error> in order to make safe methods
> - Link to v4: https://lore.kernel.org/rust-for-linux/20250314034910.134463-1-christiansantoslima21@xxxxxxxxx/
>
> Changes in v5:
> - Changed from Result to Option
> - Removed commentaries
> - Returned trait impl to unsafe
> - Link to v5: https://lore.kernel.org/rust-for-linux/20250320014041.101470-1-christiansantoslima21@xxxxxxxxx/
>
> Changes in v6:
> - Add endianess check to doc test and use match to check
> success case
> - Reformulated safety comments
> ---
> rust/kernel/transmute.rs | 89 +++++++++++++++++++++++++++++++++++++---
> 1 file changed, 83 insertions(+), 6 deletions(-)
>
> diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
> index 1c7d43771a37..16dfa5c7d467 100644
> --- a/rust/kernel/transmute.rs
> +++ b/rust/kernel/transmute.rs
> @@ -9,29 +9,106 @@
> ///
> /// It's okay for the type to have padding, as initializing those bytes has no effect.
> ///
> +/// # Example
> +/// ```
> +/// let foo = &[1, 2, 3, 4];
> +///
> +/// let result = u32::from_bytes(foo);
> +///
> +/// #[cfg(target_endian = "little")]
> +/// match result {
> +/// Some(x) => assert_eq!(*x, 0x4030201),
> +/// None => unreachable!()
> +/// }
> +///
> +/// #[cfg(target_endian = "big")]
> +/// match result {
> +/// Some(x) => assert_eq!(*x, 0x1020304),
> +/// None => unreachable!()
> +/// }
> +/// ```
> +///
> /// # Safety
> ///
> /// All bit-patterns must be valid for this type. This type must not have interior mutability.
> -pub unsafe trait FromBytes {}
> +pub unsafe trait FromBytes {
> + /// Converts a slice of bytes to a reference to `Self` when possible.
> + fn from_bytes(bytes: &[u8]) -> Option<&Self>;
> +
> + /// Converts a mutable slice of bytes to a reference to `Self` when possible.
> + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> + where
> + Self: AsBytes;
> +}
>
> macro_rules! impl_frombytes {
> ($($({$($generics:tt)*})? $t:ty, )*) => {
> // SAFETY: Safety comments written in the macro invocation.
> - $(unsafe impl$($($generics)*)? FromBytes for $t {})*
> + $(unsafe impl$($($generics)*)? FromBytes for $t {
> + fn from_bytes(bytes: &[u8]) -> Option<&$t> {
Consider factoring this out into a helper function, e.g.
```
fn from_bytes_sized<T: FromBytes + Sized>(bytes: &[u8]) -> Option<&T> {
```
which you can then call in here. If you were not trying to handle
`?Sized`, we could even put it in the trait default implementation.
> + if bytes.len() == core::mem::size_of::<$t>() {
> + let slice_ptr = bytes.as_ptr().cast::<$t>();
There's no alignment check, and so the resulting constructed reference
may be misaligned, which is UB. Same below.
> + unsafe { Some(&*slice_ptr) }
> + } else {
> + None
> + }
> + }
> +
> + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut $t>
> + where
> + Self: AsBytes,
> + {
> + if bytes.len() == core::mem::size_of::<$t>() {
> + let slice_ptr = bytes.as_mut_ptr().cast::<$t>();
> + unsafe { Some(&mut *slice_ptr) }
> + } else {
> + None
> + }
> + }
> + })*
> };
> }
>
> impl_frombytes! {
> // SAFETY: All bit patterns are acceptable values of the types below.
> + // Checking the pointer size makes this operation safe and it's necessary
> + // to dereference to get the value and return it as a reference to `Self`.
> u8, u16, u32, u64, usize,
> i8, i16, i32, i64, isize,
> -
> - // SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> - // patterns are also acceptable for arrays of that type.
> - {<T: FromBytes>} [T],
> {<T: FromBytes, const N: usize>} [T; N],
> }
>
> +// SAFETY: If all bit patterns are acceptable for individual values in an array, then all bit
> +// patterns are also acceptable for arrays of that type.
> +unsafe impl<T: FromBytes> FromBytes for [T] {
> + fn from_bytes(bytes: &[u8]) -> Option<&Self> {
> + let slice_ptr = bytes.as_ptr().cast::<T>();
> + if bytes.len() % core::mem::size_of::<T>() == 0 {
> + let slice_len = bytes.len() / core::mem::size_of::<T>();
> + // SAFETY: Since the code checks the size and can be divided into blocks of size T
> + // the slice is valid because the size is multiple of T.
> + unsafe { Some(core::slice::from_raw_parts(slice_ptr, slice_len)) }
> + } else {
> + None
> + }
> + }
> +
> + fn from_bytes_mut(bytes: &mut [u8]) -> Option<&mut Self>
> + where
> + Self: AsBytes,
> + {
> + let slice_ptr = bytes.as_mut_ptr().cast::<T>();
> + if bytes.len() % core::mem::size_of::<T>() == 0 {
> + let slice_len = bytes.len() / core::mem::size_of::<T>();
> + // SAFETY: Since the code checks the size and can be divided into blocks of size T
> + // the slice is valid because the size is multiple of T.
> + unsafe { Some(core::slice::from_raw_parts_mut(slice_ptr, slice_len)) }
> + } else {
> + None
> + }
> + }
> +}
> +
> /// Types that can be viewed as an immutable slice of initialized bytes.
> ///
> /// If a struct implements this trait, then it is okay to copy it byte-for-byte to userspace. This
> --
> 2.49.0
>
>