Re: Rust kernel policy

[Martin Uecker <uecker@tugraz.at>]

Am Freitag, dem 21.02.2025 um 12:43 -0500 schrieb Steven Rostedt:
> On Fri, 21 Feb 2025 17:28:30 +0100
> Martin Uecker <uecker@tugraz.at> wrote:
> 
> 
> > > 
> > > This kind of #pragma is basically banned in the kernel.  It's used
> > > in drivers/gpu/drm but it disables the Sparse static checker.  
> > 
> > Why is this?
> 
> Because they are arcane and even the gcc documentation recommends avoiding
> them.
> 
>  "Note that in general we do not recommend the use of pragmas"
>  https://gcc.gnu.org/onlinedocs/gcc/Pragmas.html

If you click on the link that provides the explanation, it says

"It has been found convenient to use __attribute__ to achieve a natural
attachment of attributes to their corresponding declarations, whereas
#pragma is of use for compatibility with other compilers or constructs
that do not naturally form part of the grammar. "

Regions of code do not naturally form part of the grammar, and
this is why I would like to use pragmas here.  


But I still wonder why it affects sparse?

...


> > 
> > > > 
> > > > I would also have a DYNAMIC mode that traps for UB detected at
> > > > run-time (but I understand that this is not useful for the kernel).   
> > > 
> > > No, this absolutely is useful.  This is what UBSan does now.
> > >   
> > 
> > Yes, it is similar to UBSan. The ideas to make sure that in the
> > mode there is *either* a compile-time warning *or* run-time
> > trap for any UB.  So if you fix all warnings, then any remaining
> > UB is trapped at run-time.
> 
> As long as we allow known UB. We have code that (ab)uses UB behavior in gcc
> that can't work without it. For instance, static calls. Now if the compiler
> supported static calls, it would be great if we can use that.
> 
> What's a static call?
> 
> It's a function call that can be changed to call other functions without
> being an indirect function call (as spectre mitigations make that horribly
> slow). We use dynamic code patching to update the static calls.
> 
> It's used for functions that are decided at run time. For instance, are we
> on AMD or Intel to decide which functions to implement KVM.
> 
> What's the UB behavior? It's calling a void function with no parameters
> that just returns where the caller is calling a function with parameters.
> That is:
> 
> 	func(a, b, c)
> 
> where func is defined as:
> 
> 	void func(void) { return ; }

Calling a function declared in this way with arguments
would be rejected by the compiler, so I am not sure how
this works now.

If you used 

void func();

to declare the function, this is not possible anymore in C23.


But in any case, I think it is a major strength of C that you can
escape its rules when necessary. I do not intend to change this.
I just want to give people a tool to prevent unintended consequences
of UB.

Martin