Message-ID: <a2462e9e-0b65-4cbd-82d9-32298dfb781e@proton.me>
Date: Thu, 15 Aug 2024 13:49:55 +0000
From: Benno Lossin <benno.lossin@...ton.me>
To: Danilo Krummrich <dakr@...nel.org>
Cc: ojeda@...nel.org, alex.gaynor@...il.com, wedsonaf@...il.com, boqun.feng@...il.com, gary@...yguo.net, bjorn3_gh@...tonmail.com, a.hindborg@...sung.com, aliceryhl@...gle.com, akpm@...ux-foundation.org, daniel.almeida@...labora.com, faith.ekstrand@...labora.com, boris.brezillon@...labora.com, lina@...hilina.net, mcanal@...lia.com, zhiw@...dia.com, cjia@...dia.com, jhubbard@...dia.com, airlied@...hat.com, ajanulgu@...hat.com, lyude@...hat.com, linux-kernel@...r.kernel.org, rust-for-linux@...r.kernel.org, linux-mm@...ck.org
Subject: Re: [PATCH v5 01/26] rust: alloc: add `Allocator` trait

On 15.08.24 02:16, Danilo Krummrich wrote:
> On Wed, Aug 14, 2024 at 04:13:06PM +0000, Benno Lossin wrote:
>> On 12.08.24 20:22, Danilo Krummrich wrote:
>>> +/// # Safety
>>> +///
>>> +/// Memory returned from an allocator must point to a valid memory buffer and remain valid until
>>> +/// it is explicitly freed.
>>
>> I wouldn't say that an allocator "returns memory", and in general I
>> don't think the structure of the safety comment here is nice, how about
>> the following: we put "Implementers must ensure that all trait functions
>> abide by the guarantees documented in the `# Guarantees` sections."...
> 
> Sounds reasonable to me. Additionally, I'd still keep the part below, that says
> that any pointer to a memory allocation must bbe valid to be passed to any other [`Allocator`]
> function of the same type.

Yes of course, that should be kept.

>>> +///
>>> +/// Any pointer to a memory buffer which is currently allocated must be valid to be passed to any
>>> +/// other [`Allocator`] function of the same type.
>>> +///
>>> +/// If `realloc` is called with:
>>> +///   - a size of zero, the given memory allocation, if any, must be freed
>>> +///   - `None`, a new memory allocation must be created

Only this list should be moved.

>>> +pub unsafe trait Allocator {
>>> +    /// Allocate memory based on `layout` and `flags`.
>>> +    ///
>>> +    /// On success, returns a buffer represented as `NonNull<[u8]>` that satisfies the layout
>>> +    /// constraints (i.e. minimum size and alignment as specified by `layout`).
>>> +    ///
>>> +    /// This function is equivalent to `realloc` when called with `None`.
>>
>> ... Then we can add this here:
>>
>>     /// # Guarantees
>>     ///
>>     /// When the return value is `Ok(ptr)`, then `ptr` is
>>     /// - valid for writes (and reads after the memory has been initialized) for `layout.size()` bytes,
>>     ///   until it is passed to [`Allocator::free`] or [`Allocator::realloc`],
>>     /// - aligned to `layout.align()`,
>>     /// - is valid for reads, if `flags.contains(flags::__GFP_ZERO)`,
>>
>> Do we need to handle other flags?
> 
> The whole flags thing is a bit difficult to represent here properly.
> 
> Theoretically, we'd need to add that it guarantees that the memory is zeroed for
> __GFP_ZERO, non-blocking for GFP_NOWAIT, etc. But, I think we shouldn't
> re-iterate all different behavior for the different flags.

If there are good docs, then link them.

> Another inconvenience is that not all page flags are honored or make sense for
> all allocators. This is especially inconvenient for `KVmalloc` where we can't
> even say if we end up in vrealloc() or krealloc(). kvmalloc() even contains a
> couple of flag fixups for this reason [2].

I am wondering if we want to encode this in the type system...

> I think we should just point to [1], which should document everything already.
> 
> [1] https://elixir.bootlin.com/linux/v6.10.4/source/include/linux/gfp_types.h
> [2] https://elixir.bootlin.com/linux/v6.10.4/source/mm/util.c#L612
> 
>> Also IIRC the memory given to us by C is considered initialized by Rust
>> (though it has a non-deterministic value), so we might have an
>> unconditional "valid for reads". Am I correct?
> 
> Yes, but as you say, unless allocated with __GFP_ZERO, it contains non-deterministic data. It may
> even contain old data from previous allocations.

Yeah, but IIRC that is not a soundness issue. So memory coming from C is
always considered initialized by Rust. Whereas
`MaybeUninit::uninit().assume_init()` is insta-UB, reading such memory
should be fine (just not useful).

>>> +    /// by this allocator. The alignment encoded in `layout` must be smaller than or equal to the
>>> +    /// alignment requested in the previous `alloc` or `realloc` call of the same allocation.
>>> +    ///
>>> +    /// Additionally, `ptr` is allowed to be `None`; in this case a new memory allocation is
>>> +    /// created.
>>
>> This Safety section does not talk about the case `layout.size() == 0`,
>> but it should have the same requirement as `free()`.
>>
>> Also add a `# Guarantees` section here:
>>
>>     /// # Guarantees
>>     ///
>>     /// This function has the same guarantees as [`Allocator::alloc`]. When `ptr == Some(p)`, then it
>>     /// additionally has the following:
>>     /// - when `Ok(ret_ptr)` is the return value, then
>>     ///   `ret_ptr[0..min(layout.size(), old_size)] == p[0..min(layout.size(), old_size)]`, where
>>     ///   `old_size` is the size of the allocation that `p` points at.
> 
> We could also say "The contents of the memory pointed to by `p` are preserved
> up to the lesser of the new and old size." But I'm fine with both.

I can read and write the math-ish syntax better, so I would prefer that
over words. If others think we should use words, then we can discuss.

---
Cheers,
Benno

Powered by blists - more mailing lists