linux-kernel - Re: [PATCH v2 1/2] rust: introduce abstractions for fwctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260123122502.006a01c3.zhiw@nvidia.com>
Date: Fri, 23 Jan 2026 12:25:02 +0200
From: Zhi Wang <zhiw@...dia.com>
To: Joel Fernandes <joelagnelf@...dia.com>
CC: <rust-for-linux@...r.kernel.org>, <linux-pci@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <dakr@...nel.org>, <aliceryhl@...gle.com>,
	<jgg@...dia.com>
Subject: Re: [PATCH v2 1/2] rust: introduce abstractions for fwctl

On Thu, 22 Jan 2026 16:17:55 -0500
Joel Fernandes <joelagnelf@...dia.com> wrote:

> On Thu, Jan 22, 2026 at 10:42:30PM +0200, Zhi Wang wrote:
> > +    /// Called when a userspace RPC request is received.
> > +    fn fw_rpc(
> > +        uctx: &mut UserCtx<Self::UserCtx>,
> > +        scope: u32,
> > +        rpc_in: &mut [u8],
> > +        out_len: *mut usize,
> > +    ) -> Result<Option<KVec<u8>>, Error>;
> 
> Exposing a raw pointer in the trait API means drivers that want to
> "reuse input buffer" need to write unsafe code right?
> 
>     unsafe { *out_len = ... };
> 
> I believe the unsafe code should be confined to the abstraction layer
> instead, not in the driver.
> 
> How about using using an enum return type instead to properly wrap
> inplace versus driver allocated outputs?
> 
>     pub enum RpcOutput {
>         Allocated(KVec<u8>),
>         InPlace(usize),
>     }
> 
>     fn fw_rpc(
>         uctx: &mut UserCtx<Self::UserCtx>,
>         scope: u32,
>         rpc_in: &mut [u8],
>     ) -> Result<RpcOutput, Error>;
> 
> Then the abstraction handles the pointer write:
> 
>     match T::fw_rpc(ctx, scope, rpc_in_slice) {
>         Ok(RpcOutput::Allocated(kvec)) => {
>             ...
>         }
>         Ok(RpcOutput::InPlace(len)) => {
>             unsafe { *out_len = len };
> 	    ...
>         }
>     }
> 
> fw_rpc() as a bonus also gets 1 less function parameter and cleaner
> return signature.
> 

This is a good idea. Noted. :)

> --
> Joel Fernandes
>