Re: Rust kernel policy

[Linus Torvalds <torvalds@linux-foundation.org>]

On Fri, 21 Feb 2025 at 11:59, Martin Uecker <uecker@tugraz.at> wrote:
>
> The standardized version of __attribute__(()) would look like
>
> [[safety(ON)]];
> ....
>
> [[safety(OFF)]];
>
> which is not bad (and what C++ seems to plan for profiles),
> but this also does not nest and is a bit more limited to where
> it can be used relative _Pragma.  I don't really see any advantage.
>
> GCC has
>
> #pragma GCC diagnostic push "-Wxyz"
> #pragma GCC diagnostic pop
>
> for nesting. Also not great.

I realize that the manual nesting model can be useful, but I do think
the "default" should be to aim for always associating these kinds of
things with actual code (or data), and use the normal block nesting
rules.

If you are writing safe code - or better yet, you are compiling
everything in safe mode, and have to annotate the unsafe code - you
want to annotate the particular *block* that is safe/unsafe. Not this
kind of "safe on/safe off" model.

At least with the __attribute__ model (or "[[..]]" if you prefer that
syntax) it is very much designed for the proper nesting behavior.
That's how attributes were designed.

Afaik #pragma has _no_ such mode at all (but hey, most of it is
compiler-specific random stuff, so maybe some of the #pragma uses are
"this block only"), and I don't think _Pragma() is not any better in
that respect (but again, since it has no real rules, again I guess it
could be some random thing for different pragmas).

              Linus