| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <aK-kd3GBhxOzt_mA@fedora>
Date: Thu, 28 Aug 2025 08:36:07 +0800
From: Ming Lei <ming.lei@...hat.com>
To: Sidong Yang <sidong.yang@...iosa.ai>
Cc: Jens Axboe <axboe@...nel.dk>,
Daniel Almeida <daniel.almeida@...labora.com>,
Caleb Sander Mateos <csander@...estorage.com>,
Benno Lossin <lossin@...nel.org>, Miguel Ojeda <ojeda@...nel.org>,
Arnd Bergmann <arnd@...db.de>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
rust-for-linux@...r.kernel.org, linux-kernel@...r.kernel.org,
io-uring@...r.kernel.org
Subject: Re: [RFC PATCH v3 3/5] rust: io_uring: introduce rust abstraction
for io-uring cmd
On Fri, Aug 22, 2025 at 12:55:53PM +0000, Sidong Yang wrote:
> Implment the io-uring abstractions needed for miscdevicecs and other
> char devices that have io-uring command interface.
>
> * `io_uring::IoUringCmd` : Rust abstraction for `io_uring_cmd` which
> will be used as arg for `MiscDevice::uring_cmd()`. And driver can get
> `cmd_op` sent from userspace. Also it has `flags` which includes option
> that is reissued.
>
> * `io_uring::IoUringSqe` : Rust abstraction for `io_uring_sqe` which
> could be get from `IoUringCmd::sqe()` and driver could get `cmd_data`
> from userspace. Also `IoUringSqe` has more data like opcode could be used in
> driver.
>
> Signed-off-by: Sidong Yang <sidong.yang@...iosa.ai>
> ---
> rust/kernel/io_uring.rs | 306 ++++++++++++++++++++++++++++++++++++++++
> rust/kernel/lib.rs | 1 +
> 2 files changed, 307 insertions(+)
> create mode 100644 rust/kernel/io_uring.rs
>
> diff --git a/rust/kernel/io_uring.rs b/rust/kernel/io_uring.rs
> new file mode 100644
> index 000000000000..61e88bdf4e42
> --- /dev/null
> +++ b/rust/kernel/io_uring.rs
> @@ -0,0 +1,306 @@
> +// SPDX-License-Identifier: GPL-2.0
> +// SPDX-FileCopyrightText: (C) 2025 Furiosa AI
> +
> +//! Abstractions for io-uring.
> +//!
> +//! This module provides types for implements io-uring interface for char device.
> +//!
> +//!
> +//! C headers: [`include/linux/io_uring/cmd.h`](srctree/include/linux/io_uring/cmd.h) and
> +//! [`include/linux/io_uring/io_uring.h`](srctree/include/linux/io_uring/io_uring.h)
> +
> +use core::{mem::MaybeUninit, pin::Pin};
> +
> +use crate::error::from_result;
> +use crate::transmute::{AsBytes, FromBytes};
> +use crate::{fs::File, types::Opaque};
> +
> +use crate::prelude::*;
> +
> +/// io-uring opcode
> +pub mod opcode {
> + /// opcode for uring cmd
> + pub const URING_CMD: u32 = bindings::io_uring_op_IORING_OP_URING_CMD;
> +}
> +
> +/// A Rust abstraction for the Linux kernel's `io_uring_cmd` structure.
> +///
> +/// This structure is a safe, opaque wrapper around the raw C `io_uring_cmd`
> +/// binding from the Linux kernel. It represents a command structure used
> +/// in io_uring operations within the kernel.
> +/// This type is used internally by the io_uring subsystem to manage
> +/// asynchronous I/O commands.
> +///
> +/// This type should not be constructed or manipulated directly by
> +/// kernel module developers.
> +///
> +/// # INVARIANT
> +/// - `self.inner` always points to a valid, live `bindings::io_uring_cmd`.
> +#[repr(transparent)]
> +pub struct IoUringCmd {
> + /// An opaque wrapper containing the actual `io_uring_cmd` data.
> + inner: Opaque<bindings::io_uring_cmd>,
> +}
> +
> +impl IoUringCmd {
> + /// Returns the cmd_op with associated with the `io_uring_cmd`.
> + #[inline]
> + pub fn cmd_op(&self) -> u32 {
> + // SAFETY: `self.inner` is guaranteed by the type invariant to point
> + // to a live `io_uring_cmd`, so dereferencing is safe.
> + unsafe { (*self.inner.get()).cmd_op }
> + }
> +
> + /// Returns the flags with associated with the `io_uring_cmd`.
> + #[inline]
> + pub fn flags(&self) -> u32 {
> + // SAFETY: `self.inner` is guaranteed by the type invariant to point
> + // to a live `io_uring_cmd`, so dereferencing is safe.
> + unsafe { (*self.inner.get()).flags }
> + }
> +
> + /// Reads protocol data unit as `T` that impl `FromBytes` from uring cmd
> + ///
> + /// Fails with [`EFAULT`] if size of `T` is bigger than pdu size.
> + #[inline]
> + pub fn read_pdu<T: FromBytes>(&self) -> Result<T> {
> + // SAFETY: `self.inner` is guaranteed by the type invariant to point
> + // to a live `io_uring_cmd`, so dereferencing is safe.
> + let inner = unsafe { &mut *self.inner.get() };
> +
> + let len = size_of::<T>();
> + if len > inner.pdu.len() {
> + return Err(EFAULT);
> + }
> +
> + let mut out: MaybeUninit<T> = MaybeUninit::uninit();
> + let ptr = &raw mut inner.pdu as *const c_void;
> +
> + // SAFETY:
> + // * The `ptr` is valid pointer from `self.inner` that is guaranteed by type invariant.
> + // * The `out` is valid pointer that points `T` which impls `FromBytes` and checked
> + // size of `T` is smaller than pdu size.
> + unsafe {
> + core::ptr::copy_nonoverlapping(ptr, out.as_mut_ptr().cast::<c_void>(), len);
> + }
> +
> + // SAFETY: The read above has initialized all bytes in `out`, and since `T` implements
> + // `FromBytes`, any bit-pattern is a valid value for this type.
> + Ok(unsafe { out.assume_init() })
> + }
> +
> + /// Writes the provided `value` to `pdu` in uring_cmd `self`
> + ///
> + /// Fails with [`EFAULT`] if size of `T` is bigger than pdu size.
> + #[inline]
> + pub fn write_pdu<T: AsBytes>(&mut self, value: &T) -> Result<()> {
> + // SAFETY: `self.inner` is guaranteed by the type invariant to point
> + // to a live `io_uring_cmd`, so dereferencing is safe.
> + let inner = unsafe { &mut *self.inner.get() };
> +
> + let len = size_of::<T>();
> + if len > inner.pdu.len() {
> + return Err(EFAULT);
> + }
> +
> + let src = (value as *const T).cast::<c_void>();
> + let dst = &raw mut inner.pdu as *mut c_void;
> +
> + // SAFETY:
> + // * The `src` is points valid memory that is guaranteed by `T` impls `AsBytes`
> + // * The `dst` is valid. It's from `self.inner` that is guaranteed by type invariant.
> + // * It's safe to copy because size of `T` is no more than len of pdu.
> + unsafe {
> + core::ptr::copy_nonoverlapping(src, dst, len);
> + }
> +
> + Ok(())
> + }
pdu is part of IoUringCmd, which is live in the whole uring_cmd lifetime. But
both read_pdu()/write_pdu() needs copy to read or write any byte in the pdu, which
is slow and hard to use, it could be more efficient to add two methods to return
Result<&T> and Result<mut &T> for user to manipulate uring_cmd's pdu.
Thanks,
Ming
Powered by blists - more mailing lists