| Message ID | 20240801000641.1882-5-dakr@kernel.org (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Generic `Allocator` support for Rust | expand |
On Thu, Aug 1, 2024 at 2:07 AM Danilo Krummrich <dakr@kernel.org> wrote: > +/// Returns a proper size to alloc a new object aligned to `new_layout`'s alignment. > fn aligned_size(new_layout: Layout) -> usize { This comment could potentially be moved to the previous patch that defined the function. > +struct ReallocFunc( > + // INVARIANT: One of the following `krealloc`, `vrealloc`, `kvrealloc`. > + unsafe extern "C" fn(*const core::ffi::c_void, usize, u32) -> *mut core::ffi::c_void, > +); In this case, the comment would usually be formatted with markdown. /// # Invariants /// /// Must contain one of the following: `krealloc`, `vrealloc`, `kvrealloc`. The // INVARIANT: syntax is used when constructing an instance to argue why the documentented invariants are satisfied. > +impl ReallocFunc { > + fn krealloc() -> Self { > + Self(bindings::krealloc) > + } Technically this should have an // INVARIANT: explaining why the invariants are satisfied by this new value. > + > + // SAFETY: `call` has the exact same safety requirements as `Allocator::realloc`. > + unsafe fn call( Similarly to the above, the // SAFETY: syntax is used when arguing why the preconditions are satisfied, but when explaining what the preconditions are, we usually use this syntax instead: /// # Safety /// /// This method has the same safety requirements as `Allocator::realloc`. > + &self, > + ptr: Option<NonNull<u8>>, > + layout: Layout, > + flags: Flags, > + ) -> Result<NonNull<[u8]>, AllocError> { > + let size = aligned_size(layout); > + let ptr = match ptr { > + Some(ptr) => ptr.as_ptr(), > + None => ptr::null(), > + }; > + > + // SAFETY: `ptr` is valid by the safety requirements of this function. > + let raw_ptr = unsafe { > + // If `size == 0` and `ptr != NULL` the memory behind the pointer is freed. > + self.0(ptr.cast(), size, flags.0).cast() > + }; > + > + let ptr = if size == 0 { > + NonNull::dangling() > + } else { > + NonNull::new(raw_ptr).ok_or(AllocError)? > + }; > + > + Ok(NonNull::slice_from_raw_parts(ptr, size)) > + } > +} > + > +unsafe impl Allocator for Kmalloc { > + unsafe fn realloc( > + ptr: Option<NonNull<u8>>, > + layout: Layout, > + flags: Flags, > + ) -> Result<NonNull<[u8]>, AllocError> { > + let realloc = ReallocFunc::krealloc(); > + > + // SAFETY: If not `None`, `ptr` is guaranteed to point to valid memory, which was previously > + // allocated with this `Allocator`. > + unsafe { realloc.call(ptr, layout, flags) } > + } > +} > + > unsafe impl GlobalAlloc for Kmalloc { > unsafe fn alloc(&self, layout: Layout) -> *mut u8 { > // SAFETY: `ptr::null_mut()` is null and `layout` has a non-zero size by the function safety > -- > 2.45.2 >
On Thu, Aug 01, 2024 at 10:28:09AM +0200, Alice Ryhl wrote: > On Thu, Aug 1, 2024 at 2:07 AM Danilo Krummrich <dakr@kernel.org> wrote: > > +/// Returns a proper size to alloc a new object aligned to `new_layout`'s alignment. > > fn aligned_size(new_layout: Layout) -> usize { > > This comment could potentially be moved to the previous patch that > defined the function. > > > +struct ReallocFunc( > > + // INVARIANT: One of the following `krealloc`, `vrealloc`, `kvrealloc`. > > + unsafe extern "C" fn(*const core::ffi::c_void, usize, u32) -> *mut core::ffi::c_void, > > +); > > In this case, the comment would usually be formatted with markdown. > > /// # Invariants > /// > /// Must contain one of the following: `krealloc`, `vrealloc`, `kvrealloc`. > > The // INVARIANT: syntax is used when constructing an instance to > argue why the documentented invariants are satisfied. > > > +impl ReallocFunc { > > + fn krealloc() -> Self { > > + Self(bindings::krealloc) > > + } > > Technically this should have an // INVARIANT: explaining why the > invariants are satisfied by this new value. > > > + > > + // SAFETY: `call` has the exact same safety requirements as `Allocator::realloc`. > > + unsafe fn call( > > Similarly to the above, the // SAFETY: syntax is used when arguing why > the preconditions are satisfied, but when explaining what the > preconditions are, we usually use this syntax instead: > > /// # Safety > /// > /// This method has the same safety requirements as `Allocator::realloc`. Agreed, I will change this one and the above. > > > + &self, > > + ptr: Option<NonNull<u8>>, > > + layout: Layout, > > + flags: Flags, > > + ) -> Result<NonNull<[u8]>, AllocError> { > > + let size = aligned_size(layout); > > + let ptr = match ptr { > > + Some(ptr) => ptr.as_ptr(), > > + None => ptr::null(), > > + }; > > + > > + // SAFETY: `ptr` is valid by the safety requirements of this function. > > + let raw_ptr = unsafe { > > + // If `size == 0` and `ptr != NULL` the memory behind the pointer is freed. > > + self.0(ptr.cast(), size, flags.0).cast() > > + }; > > + > > + let ptr = if size == 0 { > > + NonNull::dangling() > > + } else { > > + NonNull::new(raw_ptr).ok_or(AllocError)? > > + }; > > + > > + Ok(NonNull::slice_from_raw_parts(ptr, size)) > > + } > > +} > > + > > +unsafe impl Allocator for Kmalloc { > > + unsafe fn realloc( > > + ptr: Option<NonNull<u8>>, > > + layout: Layout, > > + flags: Flags, > > + ) -> Result<NonNull<[u8]>, AllocError> { > > + let realloc = ReallocFunc::krealloc(); > > + > > + // SAFETY: If not `None`, `ptr` is guaranteed to point to valid memory, which was previously > > + // allocated with this `Allocator`. > > + unsafe { realloc.call(ptr, layout, flags) } > > + } > > +} > > + > > unsafe impl GlobalAlloc for Kmalloc { > > unsafe fn alloc(&self, layout: Layout) -> *mut u8 { > > // SAFETY: `ptr::null_mut()` is null and `layout` has a non-zero size by the function safety > > -- > > 2.45.2 > > >
diff --git a/rust/kernel/alloc.rs b/rust/kernel/alloc.rs index b79dd2c49277..8cabc888393b 100644 --- a/rust/kernel/alloc.rs +++ b/rust/kernel/alloc.rs @@ -4,7 +4,7 @@ #[cfg(not(test))] #[cfg(not(testlib))] -mod allocator; +pub mod allocator; pub mod box_ext; pub mod vec_ext; diff --git a/rust/kernel/alloc/allocator.rs b/rust/kernel/alloc/allocator.rs index 10774c51ae26..397ae5bcc043 100644 --- a/rust/kernel/alloc/allocator.rs +++ b/rust/kernel/alloc/allocator.rs @@ -5,9 +5,18 @@ use super::{flags::*, Flags}; use core::alloc::{GlobalAlloc, Layout}; use core::ptr; +use core::ptr::NonNull; -struct Kmalloc; +use crate::alloc::{AllocError, Allocator}; +use crate::bindings; +/// The contiguous kernel allocator. +/// +/// The contiguous kernel allocator only ever allocates physically contiguous memory through +/// `bindings::krealloc`. +pub struct Kmalloc; + +/// Returns a proper size to alloc a new object aligned to `new_layout`'s alignment. fn aligned_size(new_layout: Layout) -> usize { // Customized layouts from `Layout::from_size_align()` can have size < align, so pad first. let layout = new_layout.pad_to_align(); @@ -18,7 +27,7 @@ fn aligned_size(new_layout: Layout) -> usize { layout.size() } -/// Calls `krealloc` with a proper size to alloc a new object aligned to `new_layout`'s alignment. +/// Calls `krealloc` with a proper size to alloc a new object. /// /// # Safety /// @@ -39,6 +48,59 @@ pub(crate) unsafe fn krealloc_aligned(ptr: *mut u8, new_layout: Layout, flags: F } } +struct ReallocFunc( + // INVARIANT: One of the following `krealloc`, `vrealloc`, `kvrealloc`. + unsafe extern "C" fn(*const core::ffi::c_void, usize, u32) -> *mut core::ffi::c_void, +); + +impl ReallocFunc { + fn krealloc() -> Self { + Self(bindings::krealloc) + } + + // SAFETY: `call` has the exact same safety requirements as `Allocator::realloc`. + unsafe fn call( + &self, + ptr: Option<NonNull<u8>>, + layout: Layout, + flags: Flags, + ) -> Result<NonNull<[u8]>, AllocError> { + let size = aligned_size(layout); + let ptr = match ptr { + Some(ptr) => ptr.as_ptr(), + None => ptr::null(), + }; + + // SAFETY: `ptr` is valid by the safety requirements of this function. + let raw_ptr = unsafe { + // If `size == 0` and `ptr != NULL` the memory behind the pointer is freed. + self.0(ptr.cast(), size, flags.0).cast() + }; + + let ptr = if size == 0 { + NonNull::dangling() + } else { + NonNull::new(raw_ptr).ok_or(AllocError)? + }; + + Ok(NonNull::slice_from_raw_parts(ptr, size)) + } +} + +unsafe impl Allocator for Kmalloc { + unsafe fn realloc( + ptr: Option<NonNull<u8>>, + layout: Layout, + flags: Flags, + ) -> Result<NonNull<[u8]>, AllocError> { + let realloc = ReallocFunc::krealloc(); + + // SAFETY: If not `None`, `ptr` is guaranteed to point to valid memory, which was previously + // allocated with this `Allocator`. + unsafe { realloc.call(ptr, layout, flags) } + } +} + unsafe impl GlobalAlloc for Kmalloc { unsafe fn alloc(&self, layout: Layout) -> *mut u8 { // SAFETY: `ptr::null_mut()` is null and `layout` has a non-zero size by the function safety
Implement `Allocator` for `Kmalloc`, the kernel's default allocator, typically used for objects smaller than page size. All memory allocations made with `Kmalloc` end up in `krealloc()`. It serves as allocator for the subsequently introduced types `KBox` and `KVec`. Signed-off-by: Danilo Krummrich <dakr@kernel.org> --- rust/kernel/alloc.rs | 2 +- rust/kernel/alloc/allocator.rs | 66 ++++++++++++++++++++++++++++++++-- 2 files changed, 65 insertions(+), 3 deletions(-)