Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230405175111.5974-1-wedsonaf@gmail.com> <20230405175111.5974-10-wedsonaf@gmail.com>
 <d5e55c0f-ed6e-19ee-4bb7-58c8fdad8e29@protonmail.com>
In-Reply-To: <d5e55c0f-ed6e-19ee-4bb7-58c8fdad8e29@protonmail.com>
From:   Wedson Almeida Filho <wedsonaf@gmail.com>
Date:   Sat, 8 Apr 2023 00:54:03 -0300
Message-ID: <CANeycqrpUEtQJG1zDfNv+3Ot+k3sLskH1v51ndiWKM6dikrxNw@mail.gmail.com>
Subject: Re: [PATCH v2 10/13] rust: introduce `current`
To:     Benno Lossin <y86-dev@protonmail.com>
Cc:     rust-for-linux@vger.kernel.org, Miguel Ojeda <ojeda@kernel.org>,
        Alex Gaynor <alex.gaynor@gmail.com>,
        Boqun Feng <boqun.feng@gmail.com>, Gary Guo <gary@garyguo.net>,
        =?UTF-8?Q?Bj=C3=B6rn_Roy_Baron?= <bjorn3_gh@protonmail.com>,
        linux-kernel@vger.kernel.org,
        Wedson Almeida Filho <walmeida@microsoft.com>,
        Ingo Molnar <mingo@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, 7 Apr 2023 at 19:36, Benno Lossin <y86-dev@protonmail.com> wrote:
>
> On 05.04.23 19:51, Wedson Almeida Filho wrote:
> > From: Wedson Almeida Filho <walmeida@microsoft.com>
> >
> > This allows Rust code to get a reference to the current task without
> > having to increment the refcount, but still guaranteeing memory safety.
> >
> > Cc: Ingo Molnar <mingo@redhat.com>
> > Cc: Peter Zijlstra <peterz@infradead.org>
> > Signed-off-by: Wedson Almeida Filho <walmeida@microsoft.com>
> > ---
> > v1 -> v2: Make `current` a macro to prevent it from escaping the caller
> >
> >   rust/helpers.c         |  6 +++
> >   rust/kernel/prelude.rs |  2 +
> >   rust/kernel/task.rs    | 93 +++++++++++++++++++++++++++++++++++++++++-
> >   3 files changed, 100 insertions(+), 1 deletion(-)
> >
> > diff --git a/rust/helpers.c b/rust/helpers.c
> > index 58a194042c86..96441744030e 100644
> > --- a/rust/helpers.c
> > +++ b/rust/helpers.c
> > @@ -100,6 +100,12 @@ bool rust_helper_refcount_dec_and_test(refcount_t *r)
> >   }
> >   EXPORT_SYMBOL_GPL(rust_helper_refcount_dec_and_test);
> >
> > +struct task_struct *rust_helper_get_current(void)
> > +{
> > +     return current;
> > +}
> > +EXPORT_SYMBOL_GPL(rust_helper_get_current);
> > +
> >   void rust_helper_get_task_struct(struct task_struct *t)
> >   {
> >       get_task_struct(t);
> > diff --git a/rust/kernel/prelude.rs b/rust/kernel/prelude.rs
> > index fcdc511d2ce8..c28587d68ebc 100644
> > --- a/rust/kernel/prelude.rs
> > +++ b/rust/kernel/prelude.rs
> > @@ -36,3 +36,5 @@ pub use super::error::{code::*, Error, Result};
> >   pub use super::{str::CStr, ThisModule};
> >
> >   pub use super::init::{InPlaceInit, Init, PinInit};
> > +
> > +pub use super::current;
> > diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs
> > index 8d7a8222990f..468387a5f7eb 100644
> > --- a/rust/kernel/task.rs
> > +++ b/rust/kernel/task.rs
> > @@ -5,7 +5,17 @@
> >   //! C header: [`include/linux/sched.h`](../../../../include/linux/sched.h).
> >
> >   use crate::bindings;
> > -use core::{cell::UnsafeCell, ptr};
> > +use core::{cell::UnsafeCell, marker::PhantomData, ops::Deref, ptr};
> > +
> > +/// Returns the currently running task.
> > +#[macro_export]
> > +macro_rules! current {
> > +    () => {
> > +        // SAFETY: Deref + addr-of below create a temporary `TaskRef` that cannot outlive the
> > +        // caller.
> > +        unsafe { &*$crate::task::Task::current() }
> > +    };
> > +}
> >
> >   /// Wraps the kernel's `struct task_struct`.
> >   ///
> > @@ -13,6 +23,42 @@ use core::{cell::UnsafeCell, ptr};
> >   ///
> >   /// Instances of this type are always ref-counted, that is, a call to `get_task_struct` ensures
> >   /// that the allocation remains valid at least until the matching call to `put_task_struct`.
> > +///
> > +/// # Examples
> > +///
> > +/// The following is an example of getting the PID of the current thread with zero additional cost
> > +/// when compared to the C version:
> > +///
> > +/// ```
> > +/// let pid = current!().pid();
> > +/// ```
> > +///
> > +/// Getting the PID of the current process, also zero additional cost:
> > +///
> > +/// ```
> > +/// let pid = current!().group_leader().pid();
> > +/// ```
> > +///
> > +/// Getting the current task and storing it in some struct. The reference count is automatically
> > +/// incremented when creating `State` and decremented when it is dropped:
> > +///
> > +/// ```
> > +/// use kernel::{task::Task, types::ARef};
> > +///
> > +/// struct State {
> > +///     creator: ARef<Task>,
> > +///     index: u32,
> > +/// }
> > +///
> > +/// impl State {
> > +///     fn new() -> Self {
> > +///         Self {
> > +///             creator: current!().into(),
> > +///             index: 0,
> > +///         }
> > +///     }
> > +/// }
> > +/// ```
> >   #[repr(transparent)]
> >   pub struct Task(pub(crate) UnsafeCell<bindings::task_struct>);
> >
> > @@ -25,6 +71,24 @@ unsafe impl Sync for Task {}
> >   type Pid = bindings::pid_t;
> >
> >   impl Task {
> > +    /// Returns a task reference for the currently executing task/thread.
> > +    ///
>
> Add a link to the `current!` macro as a safe version of this function.

Good idea, I'll add it in v3.

> > +    /// # Safety
> > +    ///
> > +    /// Callers must ensure that the returned [`TaskRef`] doesn't outlive the current task/thread.
> > +    pub unsafe fn current<'a>() -> TaskRef<'a> {
> > +        // SAFETY: Just an FFI call with no additional safety requirements.
> > +        let ptr = unsafe { bindings::get_current() };
> > +
> > +        TaskRef {
> > +            // SAFETY: If the current thread is still running, the current task is valid. Given
> > +            // that `TaskRef` is not `Send`, we know it cannot be transferred to another thread
> > +            // (where it could potentially outlive the caller).
> > +            task: unsafe { &*ptr.cast() },
> > +            _not_send: PhantomData,
> > +        }
> > +    }
> > +
> >       /// Returns the group leader of the given task.
> >       pub fn group_leader(&self) -> &Task {
> >           // SAFETY: By the type invariant, we know that `self.0` is valid.
> > @@ -69,3 +133,30 @@ unsafe impl crate::types::AlwaysRefCounted for Task {
> >           unsafe { bindings::put_task_struct(obj.cast().as_ptr()) }
> >       }
> >   }
> > +
> > +/// A wrapper for a shared reference to [`Task`] that isn't [`Send`].
> > +///
> > +/// We make this explicitly not [`Send`] so that we can use it to represent the current thread
> > +/// without having to increment/decrement the task's reference count.
> > +///
> > +/// # Invariants
> > +///
> > +/// The wrapped [`Task`] remains valid for the lifetime of the object.
> > +pub struct TaskRef<'a> {
> > +    task: &'a Task,
> > +    _not_send: PhantomData<*mut ()>,
> > +}
> > +
> > +impl Deref for TaskRef<'_> {
> > +    type Target = Task;
> > +
> > +    fn deref(&self) -> &Self::Target {
> > +        self.task
> > +    }
> > +}
> > +
> > +impl From<TaskRef<'_>> for crate::types::ARef<Task> {
> > +    fn from(t: TaskRef<'_>) -> Self {
> > +        t.deref().into()
> > +    }
> > +}
>
> Maybe we can hide this struct and return an `impl Deref<Target = Task>`
> in `Task::current` instead (it will still be `!Send`)? Users do not
> really need to see this implementation detail.

Hmm, I was a bit concerned with the impl of `From<TaskRef>` for
`ARef<Task>`, but it seems to work. I moved the whole type into
`Task::current` for v3.

Thanks for review!

Cheers,
-Wedson