[PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Alice Ryhl]

When combining `UnsafeCell` with `MaybeUninit`, it is idiomatic to use
`UnsafeCell` as the outer type. Intuitively, this is because a
`MaybeUninit<T>` might not contain a `T`, but we always want the effect
of the `UnsafeCell`, even if the inner value is uninitialized.

Now, strictly speaking, this doesn't really make a difference. The
compiler will always apply the `UnsafeCell` effect even if the inner
value is uninitialized. But I think we should follow the convention
here.

Signed-off-by: Alice Ryhl <aliceryhl@google.com>
---
 rust/kernel/types.rs | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
index 1e5380b16ed5..fb41635f1e1f 100644
--- a/rust/kernel/types.rs
+++ b/rust/kernel/types.rs
@@ -224,17 +224,17 @@ fn drop(&mut self) {
 ///
 /// This is meant to be used with FFI objects that are never interpreted by Rust code.
 #[repr(transparent)]
-pub struct Opaque<T>(MaybeUninit<UnsafeCell<T>>);
+pub struct Opaque<T>(UnsafeCell<MaybeUninit<T>>);
 
 impl<T> Opaque<T> {
     /// Creates a new opaque value.
     pub const fn new(value: T) -> Self {
-        Self(MaybeUninit::new(UnsafeCell::new(value)))
+        Self(UnsafeCell::new(MaybeUninit::new(value)))
     }
 
     /// Creates an uninitialised value.
     pub const fn uninit() -> Self {
-        Self(MaybeUninit::uninit())
+        Self(UnsafeCell::new(MaybeUninit::uninit()))
     }
 
     /// Creates a pin-initializer from the given initializer closure.
@@ -258,7 +258,7 @@ pub fn ffi_init(init_func: impl FnOnce(*mut T)) -> impl PinInit<Self> {
 
     /// Returns a raw pointer to the opaque data.
     pub fn get(&self) -> *mut T {
-        UnsafeCell::raw_get(self.0.as_ptr())
+        UnsafeCell::get(&self.0).cast::<T>()
     }
 
     /// Gets the value behind `this`.
@@ -266,7 +266,7 @@ pub fn get(&self) -> *mut T {
     /// This function is useful to get access to the value without creating intermediate
     /// references.
     pub const fn raw_get(this: *const Self) -> *mut T {
-        UnsafeCell::raw_get(this.cast::<UnsafeCell<T>>())
+        UnsafeCell::raw_get(this.cast::<UnsafeCell<MaybeUninit<T>>>()).cast::<T>()
     }
 }
 

base-commit: d2e3115d717197cb2bc020dd1f06b06538474ac3
-- 
2.41.0.162.gfafddb0af9-goog

Re: [PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Benno Lossin]

On 14.06.23 13:53, Alice Ryhl wrote:
> When combining `UnsafeCell` with `MaybeUninit`, it is idiomatic to use
> `UnsafeCell` as the outer type. Intuitively, this is because a
> `MaybeUninit<T>` might not contain a `T`, but we always want the effect
> of the `UnsafeCell`, even if the inner value is uninitialized.
> 
> Now, strictly speaking, this doesn't really make a difference. The
> compiler will always apply the `UnsafeCell` effect even if the inner
> value is uninitialized. But I think we should follow the convention
> here.
> 
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>

Small comment below, but I think it is fine the way it is.

Reviewed-by: Benno Lossin <benno.lossin@proton.me>

> ---
>   rust/kernel/types.rs | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
> index 1e5380b16ed5..fb41635f1e1f 100644
> --- a/rust/kernel/types.rs
> +++ b/rust/kernel/types.rs
> @@ -224,17 +224,17 @@ fn drop(&mut self) {
>   ///
>   /// This is meant to be used with FFI objects that are never interpreted by Rust code.
>   #[repr(transparent)]
> -pub struct Opaque<T>(MaybeUninit<UnsafeCell<T>>);
> +pub struct Opaque<T>(UnsafeCell<MaybeUninit<T>>);
> 
>   impl<T> Opaque<T> {
>       /// Creates a new opaque value.
>       pub const fn new(value: T) -> Self {
> -        Self(MaybeUninit::new(UnsafeCell::new(value)))
> +        Self(UnsafeCell::new(MaybeUninit::new(value)))
>       }
> 
>       /// Creates an uninitialised value.
>       pub const fn uninit() -> Self {
> -        Self(MaybeUninit::uninit())
> +        Self(UnsafeCell::new(MaybeUninit::uninit()))
>       }
> 
>       /// Creates a pin-initializer from the given initializer closure.
> @@ -258,7 +258,7 @@ pub fn ffi_init(init_func: impl FnOnce(*mut T)) -> impl PinInit<Self> {
> 
>       /// Returns a raw pointer to the opaque data.
>       pub fn get(&self) -> *mut T {
> -        UnsafeCell::raw_get(self.0.as_ptr())
> +        UnsafeCell::get(&self.0).cast::<T>()

Is there a reason you don't do `self.0.get().cast::<T>()`?

-- 
Cheers,
Benno

>       }
> 
>       /// Gets the value behind `this`.
> @@ -266,7 +266,7 @@ pub fn get(&self) -> *mut T {
>       /// This function is useful to get access to the value without creating intermediate
>       /// references.
>       pub const fn raw_get(this: *const Self) -> *mut T {
> -        UnsafeCell::raw_get(this.cast::<UnsafeCell<T>>())
> +        UnsafeCell::raw_get(this.cast::<UnsafeCell<MaybeUninit<T>>>()).cast::<T>()
>       }
>   }
> 
> 
> base-commit: d2e3115d717197cb2bc020dd1f06b06538474ac3
> --
> 2.41.0.162.gfafddb0af9-goog
> 

Re: [PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Alice Ryhl]

On 6/14/23 16:27, Benno Lossin wrote:>> @@ -258,7 +258,7 @@ pub fn 
ffi_init(init_func: impl FnOnce(*mut T)) -> impl PinInit<Self> {
>>
>>        /// Returns a raw pointer to the opaque data.
>>        pub fn get(&self) -> *mut T {
>> -        UnsafeCell::raw_get(self.0.as_ptr())
>> +        UnsafeCell::get(&self.0).cast::<T>()
> 
> Is there a reason you don't do `self.0.get().cast::<T>()`?
> 

Not really. I just modified what was already there.

Re: [PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Martin Rodriguez Reboredo]

On 6/14/23 08:53, Alice Ryhl wrote:
> When combining `UnsafeCell` with `MaybeUninit`, it is idiomatic to use
> `UnsafeCell` as the outer type. Intuitively, this is because a
> `MaybeUninit<T>` might not contain a `T`, but we always want the effect
> of the `UnsafeCell`, even if the inner value is uninitialized.
> 
> Now, strictly speaking, this doesn't really make a difference. The
> compiler will always apply the `UnsafeCell` effect even if the inner
> value is uninitialized. But I think we should follow the convention
> here.
> 
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
> [...]

Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com>

Re: [PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Gary Guo]

On Wed, 14 Jun 2023 11:53:28 +0000
Alice Ryhl <aliceryhl@google.com> wrote:

> When combining `UnsafeCell` with `MaybeUninit`, it is idiomatic to use
> `UnsafeCell` as the outer type. Intuitively, this is because a
> `MaybeUninit<T>` might not contain a `T`, but we always want the effect
> of the `UnsafeCell`, even if the inner value is uninitialized.
> 
> Now, strictly speaking, this doesn't really make a difference. The
> compiler will always apply the `UnsafeCell` effect even if the inner
> value is uninitialized. But I think we should follow the convention
> here.
> 
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>

Reviewed-by: Gary Guo <gary@garyguo.net>

> ---
>  rust/kernel/types.rs | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
> index 1e5380b16ed5..fb41635f1e1f 100644
> --- a/rust/kernel/types.rs
> +++ b/rust/kernel/types.rs
> @@ -224,17 +224,17 @@ fn drop(&mut self) {
>  ///
>  /// This is meant to be used with FFI objects that are never interpreted by Rust code.
>  #[repr(transparent)]
> -pub struct Opaque<T>(MaybeUninit<UnsafeCell<T>>);
> +pub struct Opaque<T>(UnsafeCell<MaybeUninit<T>>);
>  
>  impl<T> Opaque<T> {
>      /// Creates a new opaque value.
>      pub const fn new(value: T) -> Self {
> -        Self(MaybeUninit::new(UnsafeCell::new(value)))
> +        Self(UnsafeCell::new(MaybeUninit::new(value)))
>      }
>  
>      /// Creates an uninitialised value.
>      pub const fn uninit() -> Self {
> -        Self(MaybeUninit::uninit())
> +        Self(UnsafeCell::new(MaybeUninit::uninit()))
>      }
>  
>      /// Creates a pin-initializer from the given initializer closure.
> @@ -258,7 +258,7 @@ pub fn ffi_init(init_func: impl FnOnce(*mut T)) -> impl PinInit<Self> {
>  
>      /// Returns a raw pointer to the opaque data.
>      pub fn get(&self) -> *mut T {
> -        UnsafeCell::raw_get(self.0.as_ptr())
> +        UnsafeCell::get(&self.0).cast::<T>()
>      }
>  
>      /// Gets the value behind `this`.
> @@ -266,7 +266,7 @@ pub fn get(&self) -> *mut T {
>      /// This function is useful to get access to the value without creating intermediate
>      /// references.
>      pub const fn raw_get(this: *const Self) -> *mut T {
> -        UnsafeCell::raw_get(this.cast::<UnsafeCell<T>>())
> +        UnsafeCell::raw_get(this.cast::<UnsafeCell<MaybeUninit<T>>>()).cast::<T>()

This can just be `this.cast_mut().cast()` since all types involved are
transparent.

>      }
>  }
>  
> 
> base-commit: d2e3115d717197cb2bc020dd1f06b06538474ac3

Re: [PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Benno Lossin]

> > /// Gets the value behind `this`.
> > @@ -266,7 +266,7 @@ pub fn get(&self) -> *mut T {
> > /// This function is useful to get access to the value without creating intermediate
> > /// references.
> > pub const fn raw_get(this: *const Self) -> *mut T {
> > - UnsafeCell::raw_get(this.cast::<UnsafeCell<T>>())
> > + UnsafeCell::raw_get(this.cast::<UnsafeCell<MaybeUninit<T>>>()).cast::<T>()
> 
> 
> This can just be `this.cast_mut().cast()` since all types involved are
> transparent.

I would advise against that, see [1]. It would be bad for people to
assume that one is always allowed to do that. I also like it explicit here.

[1]: https://github.com/rust-lang/unsafe-code-guidelines/issues/281

--
Cheers,
Benno

Re: [PATCH] rust: make `UnsafeCell` the outer type in `Opaque`

[Miguel Ojeda]

On Wed, Jun 14, 2023 at 1:53 PM Alice Ryhl <aliceryhl@google.com> wrote:
>
> When combining `UnsafeCell` with `MaybeUninit`, it is idiomatic to use
> `UnsafeCell` as the outer type. Intuitively, this is because a
> `MaybeUninit<T>` might not contain a `T`, but we always want the effect
> of the `UnsafeCell`, even if the inner value is uninitialized.
>
> Now, strictly speaking, this doesn't really make a difference. The
> compiler will always apply the `UnsafeCell` effect even if the inner
> value is uninitialized. But I think we should follow the convention
> here.
>
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>

Applied to `rust-next`, thanks everyone!

Cheers,
Miguel