From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E6F7C52D7C for ; Thu, 15 Aug 2024 13:50:08 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 8CA356B00FF; Thu, 15 Aug 2024 09:50:07 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 852E16B0100; Thu, 15 Aug 2024 09:50:07 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 71AD46B0101; Thu, 15 Aug 2024 09:50:07 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 5156C6B00FF for ; Thu, 15 Aug 2024 09:50:07 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id B9F3780110 for ; Thu, 15 Aug 2024 13:50:06 +0000 (UTC) X-FDA: 82454613612.04.34C533D Received: from mail-40133.protonmail.ch (mail-40133.protonmail.ch [185.70.40.133]) by imf13.hostedemail.com (Postfix) with ESMTP id A89DB20018 for ; Thu, 15 Aug 2024 13:50:04 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=proton.me header.s=protonmail header.b=dvruiuGc; dmarc=pass (policy=quarantine) header.from=proton.me; spf=pass (imf13.hostedemail.com: domain of benno.lossin@proton.me designates 185.70.40.133 as permitted sender) smtp.mailfrom=benno.lossin@proton.me ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1723729745; a=rsa-sha256; cv=none; b=v4+7SykS3ocA0fHrcNq/MCsjNdUdd+O0OdZC9wj+4NA2nGCDx4I5GBISohvd30ZmWkn20G fLG/bbjxdckfuLk0zd7xXZ3X4PlWTOOXUBywsMsx8l5pbqKHtqoU2BiYAuPI84VQIZwFMM a/yjsYXlV3Ee5mWP9tigy9kPfg0GiKE= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=proton.me header.s=protonmail header.b=dvruiuGc; dmarc=pass (policy=quarantine) header.from=proton.me; spf=pass (imf13.hostedemail.com: domain of benno.lossin@proton.me designates 185.70.40.133 as permitted sender) smtp.mailfrom=benno.lossin@proton.me ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1723729745; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=KEupb37DrZI7fKTirvjR5sFyvknSbw5Bw1SxzjumzWg=; b=aaDOl+S2Osu4pD/7E8rTjrhGyycG5qvvLCxwclnG4h11Wv6xBd2BhQdpMiXQenjg1xMoLN zH0qH4VL1jxpi5LTJ0Kq+EvfUzeOyMIlZmGNsJiM6m55t37rAJ4+JPQ0uDJIh2+R3fd7Sc 7ZBlqtb5FMh37UgY8OXR1k29afgBmcg= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=proton.me; s=protonmail; t=1723729802; x=1723989002; bh=KEupb37DrZI7fKTirvjR5sFyvknSbw5Bw1SxzjumzWg=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector; b=dvruiuGcYy9XjfiiXN+udkg0CQt6KsH/wfuGMotUl+tnvX/rODk0lST+iZ2OiQnQn ofK+rV6bfXB5BUFhwHkRxXwWDbezOi0xfPg0756FKGYyko8o/b79S1V06eYZuxyHt+ olkc4sDvKn+RBP7ZOArwu/H7xbH5d1LEEOJsqFMcncPRFEwttVn8oo/66GYbKFp35y cp60QNWMkTBXeqheFwSolxhdtTIe812KSB77CrmxZFDgEpLb0lrSyZFpi4mC5UVFtA wbFxvRhSfAR91QgmTFQfuFuRKFGccDTbekjEe3FbVsWgbvlV1dGGXzXXhuGKHo+hq6 S/wzOuYpuS4HQ== Date: Thu, 15 Aug 2024 13:49:55 +0000 To: Danilo Krummrich From: Benno Lossin Cc: ojeda@kernel.org, alex.gaynor@gmail.com, wedsonaf@gmail.com, boqun.feng@gmail.com, gary@garyguo.net, bjorn3_gh@protonmail.com, a.hindborg@samsung.com, aliceryhl@google.com, akpm@linux-foundation.org, daniel.almeida@collabora.com, faith.ekstrand@collabora.com, boris.brezillon@collabora.com, lina@asahilina.net, mcanal@igalia.com, zhiw@nvidia.com, cjia@nvidia.com, jhubbard@nvidia.com, airlied@redhat.com, ajanulgu@redhat.com, lyude@redhat.com, linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH v5 01/26] rust: alloc: add `Allocator` trait Message-ID: In-Reply-To: References: <20240812182355.11641-1-dakr@kernel.org> <20240812182355.11641-2-dakr@kernel.org> Feedback-ID: 71780778:user:proton X-Pm-Message-ID: 93fe3d43e70bb7f12b5d0fa2bcfee2ab778e703f MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: A89DB20018 X-Stat-Signature: zdaogkkhr4wsoac9y9uzzbshgsqe7j6d X-Rspam-User: X-HE-Tag: 1723729804-102314 X-HE-Meta: U2FsdGVkX1+WfDoVZKBJvpEBPFfC21pgj07myq7CPJsAeHlxXDOLJ5Lwh4vUiOrsyH1w3XISXHJIn9wmtzshdPSbEOeH8tSyXs+HpBuHA7Nj5mqjlZ/NJtonPDmcIWweSRc88hoxmFtjRPnstnhlyAxqPLe1Rlx+i3sufCiAZtOX2QPWGdd8n2AE8vTdNE9XzQUMPTXNXY4hZrDThd+R2c8pc4L9G8Vud8UOZDuSRpCXhbBfATNr+qgkw+bF33tqtpMObsE6UKV6a7DBraqK0nQ0ClRrt436PZfKfBAocMoR4BT6v6dAPitZfIrxWkeS3e3DF8Ef5GGZ/SnfppyXkI3yZT25O3OixiHvqnrUNVTmWjO/5+WA2XEJbA5L+WnkgDsErhBijdmERRpaA+lQ2xB7THzYezUKsnLaGDlPgmfbFmbJo05MlK78/S2RiR/6uNH4qOMsvdxEuyg2uJpayOZ70AJBaEJg4Y742o3fL8qvat0SmXIJXw/N1N0tXEuwcrCXBvNQs1NNb4KMNlJK2z2lcb46erv53+mHl7pfvD6Q0AWCIklOLoSErEzwQqxH6IGhpUO0Yz3NjQw3Env82Y8GP6i39ZATbagCVr5yeDZnhQsVQG+yKNLyYnuTDQ+kd5or5Tpm5Ve+xFHP+/FinR7mrP/5QATYqGUQv+5mWNtio7/pxdYyaJzUHHGKr/HqLCPy2UT2DN38JkfbDVIpAlSmaqOeDA53O19lKsi8VidIIKbe4we62Z/2x0psOTxs/Nwq4is3rBMZr5jHgPGCs1ZcsnIGt6LNWwDUD2IsXFwe+jkP3+EWyjjKLxEymD/dn7xm8QcvBPmRT3cZon9M621otgZCY8BZb0tq4lORZHCjePeAUdWKeoe03uWgeV61Q7dD4qq8+2Sx5I274nqgVoKJSj0Bk2v0l51TXCm5+3lObai+nNGL+j0EZI1DCjTGYxMRz4+mnBaJMyNzmgM 0y/ryIFW 7E9BspX9+ro9d3/UOivOOjsQfmHHuWA4qXsK/GAec/pXUiDJxuEgOoqa8SEvmE9DkhEyhdJT3DsYzWlCiZQr5TeUuQaEcNTu7QCt4S+B0PvaZUIIzk1Qlox9YmZrJp/QcFgepWHmIiz43AfJZcOukJAMEpXb+sINBUv5kdEWPTw76tIDdjfqTxslX26XunPdAYZDsANoLcof/S86MArPcrSkMr5MpzK6tQyFxVqy3f+Hqca4ciNmQBj/uBbG/ZH3yGML4qwtg0ZNlNCrUJk8OclPS8podKk22U8M8mZx65lQwEvtclM4RkPVVorUGfb6YCZ4zvG8d76Z0GwY1OnesHxwB0956yL0cS6fYPhCixMul/S+bx2BpeID+QnZq/F5fsT3qP12yJ3t34L/x0sGfO8E3F6w8jFAdwD/p X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 15.08.24 02:16, Danilo Krummrich wrote: > On Wed, Aug 14, 2024 at 04:13:06PM +0000, Benno Lossin wrote: >> On 12.08.24 20:22, Danilo Krummrich wrote: >>> +/// # Safety >>> +/// >>> +/// Memory returned from an allocator must point to a valid memory buf= fer and remain valid until >>> +/// it is explicitly freed. >> >> I wouldn't say that an allocator "returns memory", and in general I >> don't think the structure of the safety comment here is nice, how about >> the following: we put "Implementers must ensure that all trait functions >> abide by the guarantees documented in the `# Guarantees` sections."... >=20 > Sounds reasonable to me. Additionally, I'd still keep the part below, tha= t says > that any pointer to a memory allocation must bbe valid to be passed to an= y other [`Allocator`] > function of the same type. Yes of course, that should be kept. >>> +/// >>> +/// Any pointer to a memory buffer which is currently allocated must b= e valid to be passed to any >>> +/// other [`Allocator`] function of the same type. >>> +/// >>> +/// If `realloc` is called with: >>> +/// - a size of zero, the given memory allocation, if any, must be f= reed >>> +/// - `None`, a new memory allocation must be created Only this list should be moved. >>> +pub unsafe trait Allocator { >>> + /// Allocate memory based on `layout` and `flags`. >>> + /// >>> + /// On success, returns a buffer represented as `NonNull<[u8]>` th= at satisfies the layout >>> + /// constraints (i.e. minimum size and alignment as specified by `= layout`). >>> + /// >>> + /// This function is equivalent to `realloc` when called with `Non= e`. >> >> ... Then we can add this here: >> >> /// # Guarantees >> /// >> /// When the return value is `Ok(ptr)`, then `ptr` is >> /// - valid for writes (and reads after the memory has been initiali= zed) for `layout.size()` bytes, >> /// until it is passed to [`Allocator::free`] or [`Allocator::real= loc`], >> /// - aligned to `layout.align()`, >> /// - is valid for reads, if `flags.contains(flags::__GFP_ZERO)`, >> >> Do we need to handle other flags? >=20 > The whole flags thing is a bit difficult to represent here properly. >=20 > Theoretically, we'd need to add that it guarantees that the memory is zer= oed for > __GFP_ZERO, non-blocking for GFP_NOWAIT, etc. But, I think we shouldn't > re-iterate all different behavior for the different flags. If there are good docs, then link them. > Another inconvenience is that not all page flags are honored or make sens= e for > all allocators. This is especially inconvenient for `KVmalloc` where we c= an't > even say if we end up in vrealloc() or krealloc(). kvmalloc() even contai= ns a > couple of flag fixups for this reason [2]. I am wondering if we want to encode this in the type system... > I think we should just point to [1], which should document everything alr= eady. >=20 > [1] https://elixir.bootlin.com/linux/v6.10.4/source/include/linux/gfp_typ= es.h > [2] https://elixir.bootlin.com/linux/v6.10.4/source/mm/util.c#L612 >=20 >> Also IIRC the memory given to us by C is considered initialized by Rust >> (though it has a non-deterministic value), so we might have an >> unconditional "valid for reads". Am I correct? >=20 > Yes, but as you say, unless allocated with __GFP_ZERO, it contains non-de= terministic data. It may > even contain old data from previous allocations. Yeah, but IIRC that is not a soundness issue. So memory coming from C is always considered initialized by Rust. Whereas `MaybeUninit::uninit().assume_init()` is insta-UB, reading such memory should be fine (just not useful). >>> + /// by this allocator. The alignment encoded in `layout` must be s= maller than or equal to the >>> + /// alignment requested in the previous `alloc` or `realloc` call = of the same allocation. >>> + /// >>> + /// Additionally, `ptr` is allowed to be `None`; in this case a ne= w memory allocation is >>> + /// created. >> >> This Safety section does not talk about the case `layout.size() =3D=3D 0= `, >> but it should have the same requirement as `free()`. >> >> Also add a `# Guarantees` section here: >> >> /// # Guarantees >> /// >> /// This function has the same guarantees as [`Allocator::alloc`]. W= hen `ptr =3D=3D Some(p)`, then it >> /// additionally has the following: >> /// - when `Ok(ret_ptr)` is the return value, then >> /// `ret_ptr[0..min(layout.size(), old_size)] =3D=3D p[0..min(layo= ut.size(), old_size)]`, where >> /// `old_size` is the size of the allocation that `p` points at. >=20 > We could also say "The contents of the memory pointed to by `p` are prese= rved > up to the lesser of the new and old size." But I'm fine with both. I can read and write the math-ish syntax better, so I would prefer that over words. If others think we should use words, then we can discuss. --- Cheers, Benno