Re: Rust kernel policy

Martin Uecker
2025-02-22T07:20:28Z

Am Freitag, dem 21.02.2025 um 12:11 -0800 schrieb Linus Torvalds:
> On Fri, 21 Feb 2025 at 11:59, Martin Uecker <uecker@tugraz.at> wrote:
> >
> > The standardized version of __attribute__(()) would look like
> >
> > [[safety(ON)]];
> > ....
> >
> > [[safety(OFF)]];
> >
> > which is not bad (and what C++ seems to plan for profiles),
> > but this also does not nest and is a bit more limited to where
> > it can be used relative _Pragma. I don't really see any advantage.
> >
> > GCC has
> >
> > #pragma GCC diagnostic push "-Wxyz"
> > #pragma GCC diagnostic pop
> >
> > for nesting. Also not great.
>
> I realize that the manual nesting model can be useful, but I do think
> the "default" should be to aim for always associating these kinds of
> things with actual code (or data), and use the normal block nesting
> rules.
>
> If you are writing safe code - or better yet, you are compiling
> everything in safe mode, and have to annotate the unsafe code - you
> want to annotate the particular *block* that is safe/unsafe. Not this
> kind of "safe on/safe off" model.
>
> At least with the __attribute__ model (or "[[..]]" if you prefer that
> syntax) it is very much designed for the proper nesting behavior.
> That's how attributes were designed.

There is no way to attach a GCC attribute to
a compound-statement. For [[]] this is indeed allowed,
so you could write

void f()
{
[[safety(DYNAMIC)]] {
}
}

but then you also force the user to create compound-statement.
Maybe this is what we want, but it seems restrictive. But I
will need to experiment with this anyhow to find out what works
best.

>
> Afaik #pragma has _no_ such mode at all (but hey, most of it is
> compiler-specific random stuff, so maybe some of the #pragma uses are
> "this block only"), and I don't think _Pragma() is not any better in
> that respect (but again, since it has no real rules, again I guess it
> could be some random thing for different pragmas).

For all the STDC pragmas that already exist in ISO C, they are
effective until the end of a compund-statement. These pragmas
are all for floating point stuff.

void f()
{
#pragma STDC FP_CONTRACT ON
}
// state is restored

but you also toggle it inside a compund-statement

void f()
{
#pragma STDC FP_CONTRACT ON
xxx;
#pragma STDC FP_CONTRACT OFF
yyy;
}
// state is restored

The problem with those is currently, that GCC does not
implement them.

I will need to think about this more.

Martin