Re: [PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[Zhi Wang <zhiw@nvidia.com>]

On Tue, 20 Oct 2026 08:28:37 +0000
Alice Ryhl <aliceryhl@google.com> wrote:

> Currently, VTable::fw_rpc_callback() takes scope as a u32, whereas C
> calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With kCFI enabled,
> enum types are encoded distinctly from integers, causing every fw_rpc
> indirect call into a Rust fwctl driver to trip a CFI failure. Thus,
> generate fwctl_rpc_scope as a newtype with a cfi_encoding attribute
> and use it in fw_rpc_callback().
> 

Thanks for the fix. Looks good to me. 

Reviewed-by: Zhi Wang <zhiw@nvidia.com>

BTW: I saw this “lru_status” needs the same treatment, guess bindgen
will someday automatically handle this?

Z.

> Cc: stable@vger.kernel.org
> Fixes: e052daab94ee ("rust: introduce abstractions for fwctl")
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
>  rust/bindgen_parameters |  2 ++
>  rust/kernel/fwctl.rs    | 12 ++++++------
>  2 files changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> index 8402b0c93545..e4f8c07743a8 100644
> --- a/rust/bindgen_parameters
> +++ b/rust/bindgen_parameters
> @@ -27,6 +27,8 @@
>  --opaque-type spinlock
>  
>  # enums that appear in indirect function calls should specify a cfi
> type +--newtype-enum fwctl_rpc_scope
> +--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
>  --newtype-enum lru_status
>  --with-attribute-custom-enum=lru_status='#[cfi_encoding="10lru_status"]'
>  
> diff --git a/rust/kernel/fwctl.rs b/rust/kernel/fwctl.rs
> index f29244fb0d1d..b7778e4d5ee0 100644
> --- a/rust/kernel/fwctl.rs
> +++ b/rust/kernel/fwctl.rs
> @@ -53,13 +53,13 @@ pub enum DeviceType {
>  #[derive(Copy, Clone, Debug, Eq, PartialEq)]
>  pub enum RpcScope {
>      /// Read/write access to device configuration.
> -    Configuration =
> bindings::fwctl_rpc_scope_FWCTL_RPC_CONFIGURATION,
> +    Configuration =
> bindings::fwctl_rpc_scope::FWCTL_RPC_CONFIGURATION.0, /// Read-only
> access to debug information.
> -    DebugReadOnly =
> bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_READ_ONLY,
> +    DebugReadOnly =
> bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_READ_ONLY.0, /// Write
> access to lockdown-compatible debug information.
> -    DebugWrite = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE,
> +    DebugWrite = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE.0,
>      /// Full read/write access to all debug information (requires
> `CAP_SYS_RAWIO`).
> -    DebugWriteFull =
> bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE_FULL,
> +    DebugWriteFull =
> bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE_FULL.0, }
>  
>  impl TryFrom<u32> for RpcScope {
> @@ -539,12 +539,12 @@ impl<T: Operations> VTable<T> {
>      /// - `out_len` must be valid for reading and writing an
> initialised `usize`. unsafe extern "C" fn fw_rpc_callback(
>          uctx: *mut bindings::fwctl_uctx,
> -        scope: u32,
> +        scope: bindings::fwctl_rpc_scope,
>          rpc_in: *mut ffi::c_void,
>          in_len: usize,
>          out_len: *mut usize,
>      ) -> *mut ffi::c_void {
> -        let scope = match RpcScope::try_from(scope) {
> +        let scope = match RpcScope::try_from(scope.0) {
>              Ok(s) => s,
>              Err(e) => return Error::to_ptr(e),
>          };
> 
> ---
> base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
> change-id: 20261020-fwctl-cfi-encoding-70766ce0a03a
> 
> Best regards,