Merge tag 'rust-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull rust updates from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Finish the move to custom FFI integer types started in the previous
     cycle and finally map 'long' to 'isize' and 'char' to 'u8'. Do a
     few cleanups on top thanks to that.

   - Start to use 'derive(CoercePointee)' on Rust >= 1.84.0.

     This is a major milestone on the path to build the kernel using
     only stable Rust features. In particular, previously we were using
     the unstable features 'coerce_unsized', 'dispatch_from_dyn' and
     'unsize', and now we will use the new 'derive_coerce_pointee' one,
     which is on track to stabilization. This new feature is a macro
     that essentially expands into code that internally uses the
     unstable features that we were using before, without having to
     expose those.

     With it, stable Rust users, including the kernel, will be able to
     build custom smart pointers that work with trait objects, e.g.:

         fn f(p: &Arc<dyn Display>) {
             pr_info!("{p}\n");
         }

         let a: Arc<dyn Display> = Arc::new(42i32, GFP_KERNEL)?;
         let b: Arc<dyn Display> = Arc::new("hello there", GFP_KERNEL)?;

         f(&a); // Prints "42".
         f(&b); // Prints "hello there".

     Together with the 'arbitrary_self_types' feature that we started
     using in the previous cycle, using our custom smart pointers like
     'Arc' will eventually only rely in stable Rust.

   - Introduce 'PROCMACROLDFLAGS' environment variable to allow to link
     Rust proc macros using different flags than those used for linking
     Rust host programs (e.g. when 'rustc' uses a different C library
     than the host programs' one), which Android needs.

   - Help kernel builds under macOS with Rust enabled by accomodating
     other naming conventions for dynamic libraries (i.e. '.so' vs.
     '.dylib') which are used for Rust procedural macros. The actual
     support for macOS (i.e. the rest of the pieces needed) is provided
     out-of-tree by others, following the policy used for other parts of
     the kernel by Kbuild.

   - Run Clippy for 'rusttest' code too and clean the bits it spotted.

   - Provide Clippy with the minimum supported Rust version to improve
     the suggestions it gives.

   - Document 'bindgen' 0.71.0 regression.

  'kernel' crate:

   - 'build_error!': move users of the hidden function to the documented
     macro, prevent such uses in the future by moving the function
     elsewhere and add the macro to the prelude.

   - 'types' module: add improved version of 'ForeignOwnable::borrow_mut'
     (which was removed in the past since it was problematic); change
     'ForeignOwnable' pointer type to '*mut'.

   - 'alloc' module: implement 'Display' for 'Box' and align the 'Debug'
     implementation to it; add example (doctest) for 'ArrayLayout::new()'

   - 'sync' module: document 'PhantomData' in 'Arc'; use
     'NonNull::new_unchecked' in 'ForeignOwnable for Arc' impl.

   - 'uaccess' module: accept 'Vec's with different allocators in
     'UserSliceReader::read_all'.

   - 'workqueue' module: enable run-testing a couple more doctests.

   - 'error' module: simplify 'from_errno()'.

   - 'block' module: fix formatting in code documentation (a lint to catch
     these is being implemented).

   - Avoid 'unwrap()'s in doctests, which also improves the examples by
     showing how kernel code is supposed to be written.

   - Avoid 'as' casts with 'cast{,_mut}' calls which are a bit safer.

  And a few other cleanups"

* tag 'rust-6.14' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (32 commits)
  kbuild: rust: add PROCMACROLDFLAGS
  rust: uaccess: generalize userSliceReader to support any Vec
  rust: kernel: add improved version of `ForeignOwnable::borrow_mut`
  rust: kernel: reorder `ForeignOwnable` items
  rust: kernel: change `ForeignOwnable` pointer to mut
  rust: arc: split unsafe block, add missing comment
  rust: types: avoid `as` casts
  rust: arc: use `NonNull::new_unchecked`
  rust: use derive(CoercePointee) on rustc >= 1.84.0
  rust: alloc: add doctest for `ArrayLayout::new()`
  rust: init: update `stack_try_pin_init` examples
  rust: error: import `kernel`'s `LayoutError` instead of `core`'s
  rust: str: replace unwraps with question mark operators
  rust: page: remove unnecessary helper function from doctest
  rust: rbtree: remove unwrap in asserts
  rust: init: replace unwraps with question mark operators
  rust: use host dylib naming convention to support macOS
  rust: add `build_error!` to the prelude
  rust: kernel: move `build_error` hidden function to prevent mistakes
  rust: use the `build_error!` macro, not the hidden function
  ...

1 files changed, 69 insertions, 24 deletions

diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs
index ec6457bb3084..0dfaf45a755c 100644
--- a/rust/kernel/types.rs
+++ b/rust/kernel/types.rs
@@ -19,35 +19,34 @@ use core::{
 /// This trait is meant to be used in cases when Rust objects are stored in C objects and
 /// eventually "freed" back to Rust.
 pub trait ForeignOwnable: Sized {
-    /// Type of values borrowed between calls to [`ForeignOwnable::into_foreign`] and
-    /// [`ForeignOwnable::from_foreign`].
+    /// Type used to immutably borrow a value that is currently foreign-owned.
     type Borrowed<'a>;
 
+    /// Type used to mutably borrow a value that is currently foreign-owned.
+    type BorrowedMut<'a>;
+
     /// Converts a Rust-owned object to a foreign-owned one.
     ///
     /// The foreign representation is a pointer to void. There are no guarantees for this pointer.
     /// For example, it might be invalid, dangling or pointing to uninitialized memory. Using it in
-    /// any way except for [`ForeignOwnable::from_foreign`], [`ForeignOwnable::borrow`],
-    /// [`ForeignOwnable::try_from_foreign`] can result in undefined behavior.
-    fn into_foreign(self) -> *const crate::ffi::c_void;
-
-    /// Borrows a foreign-owned object.
-    ///
-    /// # Safety
+    /// any way except for [`from_foreign`], [`try_from_foreign`], [`borrow`], or [`borrow_mut`] can
+    /// result in undefined behavior.
     ///
-    /// `ptr` must have been returned by a previous call to [`ForeignOwnable::into_foreign`] for
-    /// which a previous matching [`ForeignOwnable::from_foreign`] hasn't been called yet.
-    unsafe fn borrow<'a>(ptr: *const crate::ffi::c_void) -> Self::Borrowed<'a>;
+    /// [`from_foreign`]: Self::from_foreign
+    /// [`try_from_foreign`]: Self::try_from_foreign
+    /// [`borrow`]: Self::borrow
+    /// [`borrow_mut`]: Self::borrow_mut
+    fn into_foreign(self) -> *mut crate::ffi::c_void;
 
     /// Converts a foreign-owned object back to a Rust-owned one.
     ///
     /// # Safety
     ///
-    /// `ptr` must have been returned by a previous call to [`ForeignOwnable::into_foreign`] for
-    /// which a previous matching [`ForeignOwnable::from_foreign`] hasn't been called yet.
-    /// Additionally, all instances (if any) of values returned by [`ForeignOwnable::borrow`] for
-    /// this object must have been dropped.
-    unsafe fn from_foreign(ptr: *const crate::ffi::c_void) -> Self;
+    /// The provided pointer must have been returned by a previous call to [`into_foreign`], and it
+    /// must not be passed to `from_foreign` more than once.
+    ///
+    /// [`into_foreign`]: Self::into_foreign
+    unsafe fn from_foreign(ptr: *mut crate::ffi::c_void) -> Self;
 
     /// Tries to convert a foreign-owned object back to a Rust-owned one.
     ///
@@ -56,9 +55,10 @@ pub trait ForeignOwnable: Sized {
     ///
     /// # Safety
     ///
-    /// `ptr` must either be null or satisfy the safety requirements for
-    /// [`ForeignOwnable::from_foreign`].
-    unsafe fn try_from_foreign(ptr: *const crate::ffi::c_void) -> Option<Self> {
+    /// `ptr` must either be null or satisfy the safety requirements for [`from_foreign`].
+    ///
+    /// [`from_foreign`]: Self::from_foreign
+    unsafe fn try_from_foreign(ptr: *mut crate::ffi::c_void) -> Option<Self> {
         if ptr.is_null() {
             None
         } else {
@@ -67,18 +67,63 @@ pub trait ForeignOwnable: Sized {
             unsafe { Some(Self::from_foreign(ptr)) }
         }
     }
+
+    /// Borrows a foreign-owned object immutably.
+    ///
+    /// This method provides a way to access a foreign-owned value from Rust immutably. It provides
+    /// you with exactly the same abilities as an `&Self` when the value is Rust-owned.
+    ///
+    /// # Safety
+    ///
+    /// The provided pointer must have been returned by a previous call to [`into_foreign`], and if
+    /// the pointer is ever passed to [`from_foreign`], then that call must happen after the end of
+    /// the lifetime 'a.
+    ///
+    /// [`into_foreign`]: Self::into_foreign
+    /// [`from_foreign`]: Self::from_foreign
+    unsafe fn borrow<'a>(ptr: *mut crate::ffi::c_void) -> Self::Borrowed<'a>;
+
+    /// Borrows a foreign-owned object mutably.
+    ///
+    /// This method provides a way to access a foreign-owned value from Rust mutably. It provides
+    /// you with exactly the same abilities as an `&mut Self` when the value is Rust-owned, except
+    /// that the address of the object must not be changed.
+    ///
+    /// Note that for types like [`Arc`], an `&mut Arc<T>` only gives you immutable access to the
+    /// inner value, so this method also only provides immutable access in that case.
+    ///
+    /// In the case of `Box<T>`, this method gives you the ability to modify the inner `T`, but it
+    /// does not let you change the box itself. That is, you cannot change which allocation the box
+    /// points at.
+    ///
+    /// # Safety
+    ///
+    /// The provided pointer must have been returned by a previous call to [`into_foreign`], and if
+    /// the pointer is ever passed to [`from_foreign`], then that call must happen after the end of
+    /// the lifetime 'a.
+    ///
+    /// The lifetime 'a must not overlap with the lifetime of any other call to [`borrow`] or
+    /// `borrow_mut` on the same object.
+    ///
+    /// [`into_foreign`]: Self::into_foreign
+    /// [`from_foreign`]: Self::from_foreign
+    /// [`borrow`]: Self::borrow
+    /// [`Arc`]: crate::sync::Arc
+    unsafe fn borrow_mut<'a>(ptr: *mut crate::ffi::c_void) -> Self::BorrowedMut<'a>;
 }
 
 impl ForeignOwnable for () {
     type Borrowed<'a> = ();
+    type BorrowedMut<'a> = ();
 
-    fn into_foreign(self) -> *const crate::ffi::c_void {
+    fn into_foreign(self) -> *mut crate::ffi::c_void {
         core::ptr::NonNull::dangling().as_ptr()
     }
 
-    unsafe fn borrow<'a>(_: *const crate::ffi::c_void) -> Self::Borrowed<'a> {}
+    unsafe fn from_foreign(_: *mut crate::ffi::c_void) -> Self {}
 
-    unsafe fn from_foreign(_: *const crate::ffi::c_void) -> Self {}
+    unsafe fn borrow<'a>(_: *mut crate::ffi::c_void) -> Self::Borrowed<'a> {}
+    unsafe fn borrow_mut<'a>(_: *mut crate::ffi::c_void) -> Self::BorrowedMut<'a> {}
 }
 
 /// Runs a cleanup function/closure when dropped.
@@ -434,7 +479,7 @@ impl<T: AlwaysRefCounted> ARef<T> {
     /// }
     ///
     /// let mut data = Empty {};
-    /// let ptr = NonNull::<Empty>::new(&mut data as *mut _).unwrap();
+    /// let ptr = NonNull::<Empty>::new(&mut data).unwrap();
     /// # // SAFETY: TODO.
     /// let data_ref: ARef<Empty> = unsafe { ARef::from_raw(ptr) };
     /// let raw_ptr: NonNull<Empty> = ARef::into_raw(data_ref);