[PATCH 0/3] Support more safe `AsBytes`/`FromBytes` usage

[PATCH 0/3] Support more safe `AsBytes`/`FromBytes` usage

[Matthew Maurer]

Currently:
* Slices of `AsBytes`/`FromBytes` types cannot be synthesized from
  bytes slices (without unsafe).
* Users must use `unsafe impl` to assert that structs are `AsBytes` or
  `FromBytes` and write appropriate justifications.
* Bindgen-generated types cannot implement `AsBytes` or `FromBytes`,
  meaning that casting them to or from bytes involves assumptions in the
  `unsafe impl` that could easily go out of sync if the underlying
  header is edited or an assumption is invalid on a platform the author
  did not consider.

This series seeks to address all there of these by:
1. Adding slice cast functions to `FromBytes`
2. Adding a derive for `AsBytes` and `FromBytes`, for now restricted to
   the simple case of structs.
3. Refactoring the crate structure to allow the derives added in 2 to be
   used on bindgen definitions.

1 or 2 can be taken independently, 3 requires 2.

1 and 2 I think are in pretty goood shape. 3 I'm throwing out their to
sketch out what a potential solution to this problem could look like.

Options for #3 that I can see:
* Common types/traits crate (what's done in this patch), maybe bikeshed
  name to something other than `traits`.
* Move `bindings` from being its own crate to being source-included into
  the `kernel` crate.
* Import `zerocopy` instead, and move off providing our own
  `AsBytes`/`FromBytes`. This would lose our special-casing of pointers
  as not supporting byte-casting, and require importing yet more
  third-party code, but would solve the problems I enumerated.

Signed-off-by: Matthew Maurer <mmaurer@google.com>
---
Matthew Maurer (3):
      rust: transmute: Support transmuting slices of AsBytes/FromBytes types
      rust: Add support for deriving `AsBytes` and `FromBytes`
      rust: Support deriving `AsBytes`/`FromBytes` on bindgen types

 rust/Makefile                        | 19 +++++++--
 rust/bindgen_parameters              |  8 ++++
 rust/bindings/lib.rs                 |  1 +
 rust/kernel/lib.rs                   |  3 +-
 rust/macros/lib.rs                   | 80 ++++++++++++++++++++++++++++++++++++
 rust/macros/transmute.rs             | 60 +++++++++++++++++++++++++++
 rust/traits/lib.rs                   |  6 +++
 rust/{kernel => traits}/transmute.rs | 72 ++++++++++++++++++++++++++++++++
 rust/uapi/lib.rs                     |  1 +
 9 files changed, 245 insertions(+), 5 deletions(-)
---
base-commit: 008d3547aae5bc86fac3eda317489169c3fda112
change-id: 20251212-transmute-8ab6076700a8

Best regards,
-- 
Matthew Maurer <mmaurer@google.com>

[PATCH 1/3] rust: transmute: Support transmuting slices of AsBytes/FromBytes types

[Matthew Maurer]

Currently, we support either transmuting a byte slice of the exact size
of the target type or a single element from a prefix of a byte slice.

This adds support for transmuting from a byte slice to a slice of
elements, assuming appropriate traits are implemented.

Signed-off-by: Matthew Maurer <mmaurer@google.com>
---
 rust/kernel/transmute.rs | 72 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 72 insertions(+)

diff --git a/rust/kernel/transmute.rs b/rust/kernel/transmute.rs
index be5dbf3829e25c92f85083cc0f4940f35bb7baec..5cc5f4fde4c31cea3c51ab078b4d68f3a0a2caa1 100644
--- a/rust/kernel/transmute.rs
+++ b/rust/kernel/transmute.rs
@@ -122,6 +122,78 @@ fn from_bytes_mut_prefix(bytes: &mut [u8]) -> Option<(&mut Self, &mut [u8])>
         }
     }
 
+    /// Converts a slice of bytes to a slice of `Self`.
+    ///
+    /// Succeeds if the reference is properly aligned, and the size of `bytes` is a multiple of that
+    /// of `Self`.
+    ///
+    /// Otherwise, returns [`None`].
+    fn from_bytes_to_slice(bytes: &[u8]) -> Option<&[Self]>
+    where
+        Self: Sized,
+    {
+        let size = size_of::<Self>();
+        if size == 0 {
+            return None;
+        }
+        if bytes.len() % size != 0 {
+            return None;
+        }
+        let len = bytes.len() / size;
+        let ptr = bytes.as_ptr().cast::<Self>();
+
+        #[allow(clippy::incompatible_msrv)]
+        if ptr.is_aligned() {
+            // SAFETY:
+            // - `ptr` is valid for reads of `bytes.len()` bytes, which is
+            //   `len * size_of::<Self>()`.
+            // - `ptr` is aligned for `Self`.
+            // - `ptr` points to `len` consecutive properly initialized values of type `Self`
+            //   because `Self` implements `FromBytes` (any bit pattern is valid).
+            // - The lifetime of the returned slice is bound to the input `bytes`.
+            unsafe { Some(core::slice::from_raw_parts(ptr, len)) }
+        } else {
+            None
+        }
+    }
+
+    /// Converts a mutable slice of bytes to a mutable slice of `Self`.
+    ///
+    /// Succeeds if the reference is properly aligned, and the size of `bytes` is a multiple of that
+    /// of `Self`.
+    ///
+    /// Otherwise, returns [`None`].
+    fn from_bytes_to_mut_slice(bytes: &mut [u8]) -> Option<&mut [Self]>
+    where
+        Self: AsBytes + Sized,
+    {
+        let size = size_of::<Self>();
+        if size == 0 {
+            return None;
+        }
+        if bytes.len() % size != 0 {
+            return None;
+        }
+        let len = bytes.len() / size;
+        let ptr = bytes.as_mut_ptr().cast::<Self>();
+
+        #[allow(clippy::incompatible_msrv)]
+        if ptr.is_aligned() {
+            // SAFETY:
+            // - `ptr` is valid for reads and writes of `bytes.len()` bytes, which is
+            //   `len * size_of::<Self>()`.
+            // - `ptr` is aligned for `Self`.
+            // - `ptr` points to `len` consecutive properly initialized values of type `Self`
+            //   because `Self` implements `FromBytes`.
+            // - `AsBytes` guarantees that writing a new `Self` to the resulting slice can safely
+            //   be reflected as bytes in the original slice.
+            // - The lifetime of the returned slice is bound to the input `bytes`.
+            unsafe { Some(core::slice::from_raw_parts_mut(ptr, len)) }
+        } else {
+            None
+        }
+    }
+
     /// Creates an owned instance of `Self` by copying `bytes`.
     ///
     /// Unlike [`FromBytes::from_bytes`], which requires aligned input, this method can be used on

-- 
2.52.0.305.g3fc767764a-goog

[PATCH 2/3] rust: Add support for deriving `AsBytes` and `FromBytes`

[Matthew Maurer]

This provides a derive macro for `AsBytes` and `FromBytes` for structs
only. For both, it checks the respective trait on every underlying
field. For `AsBytes`, it emits a const-time padding check that will fail
the compilation if derived on a type with padding.

Signed-off-by: Matthew Maurer <mmaurer@google.com>
---
 rust/macros/lib.rs       | 60 ++++++++++++++++++++++++++++++++++++++++++++++++
 rust/macros/transmute.rs | 58 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 118 insertions(+)

diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
index b38002151871a33f6b4efea70be2deb6ddad38e2..cec8bd3a742b3f6b3680c4286f73c8fa550a58a0 100644
--- a/rust/macros/lib.rs
+++ b/rust/macros/lib.rs
@@ -20,9 +20,11 @@
 mod kunit;
 mod module;
 mod paste;
+mod transmute;
 mod vtable;
 
 use proc_macro::TokenStream;
+use syn::{parse_macro_input, DeriveInput};
 
 /// Declares a kernel module.
 ///
@@ -475,3 +477,61 @@ pub fn paste(input: TokenStream) -> TokenStream {
 pub fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
     kunit::kunit_tests(attr, ts)
 }
+
+/// Implements `FromBytes` for a struct.
+///
+/// It will fail compilation if the struct you are deriving on cannot be determined to implement
+/// `FromBytes` safely. It may still fail for some types which would be safe to implement
+/// `FromBytes` for, in which case you will need to write the implementation and justification
+/// yourself.
+///
+/// Main reasons your type may be rejected:
+/// * Not a `struct`
+/// * One of the fields is not `FromBytes`
+///
+/// # Examples
+///
+/// ```
+/// #[derive(FromBytes)]
+/// #[repr(C)]
+/// struct Foo {
+///   x: u32,
+///   y: u16,
+///   z: u16,
+/// }
+/// ```
+#[proc_macro_derive(FromBytes)]
+pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(tokens as DeriveInput);
+    transmute::from_bytes(input).into()
+}
+
+/// Implements `AsBytes` for a struct.
+///
+/// It will fail compilation if the struct you are deriving on cannot be determined to implement
+/// `AsBytes` safely. It may still fail for some structures which would be safe to implement
+/// `AsBytes`, in which case you will need to write the implementation and justification
+/// yourself.
+///
+/// Main reasons your type may be rejected:
+/// * Not a `struct`
+/// * One of the fields is not `AsBytes`
+/// * Your struct has generic parameters
+/// * There is padding somewhere in your struct
+///
+/// # Examples
+///
+/// ```
+/// #[derive(AsBytes)]
+/// #[repr(C)]
+/// struct Foo {
+///   x: u32,
+///   y: u16,
+///   z: u16,
+/// }
+/// ```
+#[proc_macro_derive(AsBytes)]
+pub fn derive_as_bytes(tokens: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(tokens as DeriveInput);
+    transmute::as_bytes(input).into()
+}
diff --git a/rust/macros/transmute.rs b/rust/macros/transmute.rs
new file mode 100644
index 0000000000000000000000000000000000000000..43cf36a1334f1fed23c0e777026392f987f78d8d
--- /dev/null
+++ b/rust/macros/transmute.rs
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-2.0
+
+use proc_macro2::TokenStream;
+use syn::{parse_quote, DeriveInput, Fields, Ident, ItemConst, Path, WhereClause};
+
+fn all_fields_impl(fields: &Fields, trait_: &Path) -> WhereClause {
+    let tys = fields.iter().map(|field| &field.ty);
+    parse_quote! {
+        where #(for<'a> #tys: #trait_),*
+    }
+}
+
+fn struct_padding_check(fields: &Fields, name: &Ident) -> ItemConst {
+    let tys = fields.iter().map(|field| &field.ty);
+    parse_quote! {
+        const _: () = {
+            assert!(#(core::mem::size_of::<#tys>())+* == core::mem::size_of::<#name>());
+        };
+    }
+}
+
+pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
+    if !input.generics.params.is_empty() {
+        return quote::quote! { compile_error!("#[derive(AsBytes)] does not support generics") };
+    }
+    let syn::Data::Struct(ref ds) = &input.data else {
+        return quote::quote! { compile_error!("#[derive(AsBytes)] only supports structs") };
+    };
+    let name = input.ident;
+    let trait_ = parse_quote! { ::kernel::transmute::AsBytes };
+    let where_clause = all_fields_impl(&ds.fields, &trait_);
+    let padding_check = struct_padding_check(&ds.fields, &name);
+    quote::quote! {
+        #padding_check
+        // SAFETY: #name has no padding and all of its fields implement `AsBytes`
+        unsafe impl #trait_ for #name #where_clause {}
+    }
+}
+
+pub(crate) fn from_bytes(input: DeriveInput) -> TokenStream {
+    let syn::Data::Struct(ref ds) = &input.data else {
+        return quote::quote! { compile_error!("#[derive(FromBytes)] only supports structs") };
+    };
+    let (impl_generics, ty_generics, base_where_clause) = input.generics.split_for_impl();
+    let name = input.ident;
+    let trait_ = parse_quote! { ::kernel::transmute::FromBytes };
+    let mut where_clause = all_fields_impl(&ds.fields, &trait_);
+    if let Some(base_clause) = base_where_clause {
+        where_clause
+            .predicates
+            .extend(base_clause.predicates.clone())
+    };
+    quote::quote! {
+        // SAFETY: All fields of #name implement `FromBytes` and it is a struct, so there is no
+        // implicit discriminator.
+        unsafe impl #impl_generics #trait_ for #name #ty_generics #where_clause {}
+    }
+}

-- 
2.52.0.305.g3fc767764a-goog

[PATCH 3/3] rust: Support deriving `AsBytes`/`FromBytes` on bindgen types

[Matthew Maurer]

To support this, we need to move the `transmute` module into a separate
crate to allow the `bindings` crate to depend on it. Most user code is
still expected to address the module as `kernel::transmute`, which is a
re-export. `traits::transmute` is now available for use in `bindings`.

Signed-off-by: Matthew Maurer <mmaurer@google.com>
---
 rust/Makefile                        | 19 +++++++++++++++----
 rust/bindgen_parameters              |  8 ++++++++
 rust/bindings/lib.rs                 |  1 +
 rust/kernel/lib.rs                   |  3 ++-
 rust/macros/lib.rs                   | 24 ++++++++++++++++++++++--
 rust/macros/transmute.rs             | 12 +++++++-----
 rust/traits/lib.rs                   |  6 ++++++
 rust/{kernel => traits}/transmute.rs |  0
 rust/uapi/lib.rs                     |  1 +
 9 files changed, 62 insertions(+), 12 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index 5d357dce1704d15e43effc528be8f5a4d74d3d8d..bbede4b5b4faa5edeb1d33bdce338a7b76915d07 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -660,26 +660,37 @@ $(obj)/ffi.o: private skip_gendwarfksyms = 1
 $(obj)/ffi.o: $(src)/ffi.rs $(obj)/compiler_builtins.o FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init \
+	--extern traits --extern macros
 $(obj)/bindings.o: $(src)/bindings/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/traits.o \
+    $(obj)/$(libmacros_name) \
     $(obj)/bindings/bindings_generated.rs \
     $(obj)/bindings/bindings_helpers_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/traits.o: private skip_gendwarfksyms = 1
+$(obj)/traits.o: $(src)/traits/lib.rs FORCE
+	+$(call if_changed_rule,rustc_library)
+
+
+$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
+	--extern traits --extern macros
 $(obj)/uapi.o: private skip_gendwarfksyms = 1
 $(obj)/uapi.o: $(src)/uapi/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/traits.o \
+    $(obj)/$(libmacros_name) \
     $(obj)/uapi/uapi_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
 $(obj)/kernel.o: private rustc_target_flags = --extern ffi --extern pin_init \
-    --extern build_error --extern macros --extern bindings --extern uapi
+    --extern build_error --extern macros --extern bindings --extern uapi --extern traits
 $(obj)/kernel.o: $(src)/kernel/lib.rs $(obj)/build_error.o $(obj)/pin_init.o \
-    $(obj)/$(libmacros_name) $(obj)/bindings.o $(obj)/uapi.o FORCE
+    $(obj)/$(libmacros_name) $(obj)/bindings.o $(obj)/uapi.o $(obj)/traits.o FORCE
 	+$(call if_changed_rule,rustc_library)
 
 ifdef CONFIG_JUMP_LABEL
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index fd2fd1c3cb9a51ea46fcd721907783b457aa1378..60910ba8731180516b4980b9e0dc5fb0c297da55 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -64,3 +64,11 @@
 # Structs should implement `Zeroable` when all of their fields do.
 --with-derive-custom-struct .*=MaybeZeroable
 --with-derive-custom-union .*=MaybeZeroable
+
+# Every C struct can try to derive FromBytes. If they have unmet requirements,
+# the impl will just be a no-op due to the where clause.
+--with-derive-custom-struct .*=FromBytesTrait
+
+# We can't auto-derive AsBytes, as we need a const-time check to see if there
+# is padding involved. Add it explicitly when you expect no padding.
+--with-derive-custom-struct cpumask=AsBytesTrait
diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
index 0c57cf9b4004f176997c59ecc58a9a9ac76163d9..07932ab130c0a8e56e35d49ace77ae1becc09ae6 100644
--- a/rust/bindings/lib.rs
+++ b/rust/bindings/lib.rs
@@ -31,6 +31,7 @@
 #[allow(clippy::undocumented_unsafe_blocks)]
 #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
 mod bindings_raw {
+    use macros::{AsBytesTrait, FromBytesTrait};
     use pin_init::{MaybeZeroable, Zeroable};
 
     // Manual definition for blocklisted types.
diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
index f812cf12004286962985a068665443dc22c389a2..8c605f4905223077f5d824f27220c4c24e71d5f4 100644
--- a/rust/kernel/lib.rs
+++ b/rust/kernel/lib.rs
@@ -146,7 +146,6 @@
 pub mod task;
 pub mod time;
 pub mod tracepoint;
-pub mod transmute;
 pub mod types;
 pub mod uaccess;
 #[cfg(CONFIG_USB = "y")]
@@ -159,6 +158,8 @@
 pub use macros;
 pub use uapi;
 
+pub use traits::*;
+
 /// Prefix to appear before log messages printed from within the `kernel` crate.
 const __LOG_PREFIX: &[u8] = b"rust_kernel\0";
 
diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
index cec8bd3a742b3f6b3680c4286f73c8fa550a58a0..862de56339bbb18cd30a260444dc19f24b13a0d0 100644
--- a/rust/macros/lib.rs
+++ b/rust/macros/lib.rs
@@ -503,7 +503,7 @@ pub fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
 #[proc_macro_derive(FromBytes)]
 pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
     let input = parse_macro_input!(tokens as DeriveInput);
-    transmute::from_bytes(input).into()
+    transmute::from_bytes("kernel", input).into()
 }
 
 /// Implements `AsBytes` for a struct.
@@ -533,5 +533,25 @@ pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
 #[proc_macro_derive(AsBytes)]
 pub fn derive_as_bytes(tokens: TokenStream) -> TokenStream {
     let input = parse_macro_input!(tokens as DeriveInput);
-    transmute::as_bytes(input).into()
+    transmute::as_bytes("kernel", input).into()
+}
+
+#[doc(hidden)]
+#[proc_macro_derive(FromBytesTrait)]
+/// This is equivalent to `FromBytes`, but uses the `trait` crate as the trait definition site
+/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
+/// trait through `kernel`.
+pub fn derive_from_bytes_trait(tokens: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(tokens as DeriveInput);
+    transmute::from_bytes("traits", input).into()
+}
+
+#[doc(hidden)]
+#[proc_macro_derive(AsBytesTrait)]
+/// This is equivalent to `AsBytes`, but uses the `trait` crate as the trait definition site
+/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
+/// trait through `kernel`.
+pub fn derive_as_bytes_trait(tokens: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(tokens as DeriveInput);
+    transmute::as_bytes("traits", input).into()
 }
diff --git a/rust/macros/transmute.rs b/rust/macros/transmute.rs
index 43cf36a1334f1fed23c0e777026392f987f78d8d..9bd6d279675fb1d58cdceff1f4dde0dcf33fbf99 100644
--- a/rust/macros/transmute.rs
+++ b/rust/macros/transmute.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 
-use proc_macro2::TokenStream;
+use proc_macro2::{Span, TokenStream};
 use syn::{parse_quote, DeriveInput, Fields, Ident, ItemConst, Path, WhereClause};
 
 fn all_fields_impl(fields: &Fields, trait_: &Path) -> WhereClause {
@@ -19,7 +19,8 @@ fn struct_padding_check(fields: &Fields, name: &Ident) -> ItemConst {
     }
 }
 
-pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
+pub(crate) fn as_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
+    let crate_ = Ident::new(crate_, Span::call_site());
     if !input.generics.params.is_empty() {
         return quote::quote! { compile_error!("#[derive(AsBytes)] does not support generics") };
     }
@@ -27,7 +28,7 @@ pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
         return quote::quote! { compile_error!("#[derive(AsBytes)] only supports structs") };
     };
     let name = input.ident;
-    let trait_ = parse_quote! { ::kernel::transmute::AsBytes };
+    let trait_ = parse_quote! { ::#crate_::transmute::AsBytes };
     let where_clause = all_fields_impl(&ds.fields, &trait_);
     let padding_check = struct_padding_check(&ds.fields, &name);
     quote::quote! {
@@ -37,13 +38,14 @@ unsafe impl #trait_ for #name #where_clause {}
     }
 }
 
-pub(crate) fn from_bytes(input: DeriveInput) -> TokenStream {
+pub(crate) fn from_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
+    let crate_ = Ident::new(crate_, Span::call_site());
     let syn::Data::Struct(ref ds) = &input.data else {
         return quote::quote! { compile_error!("#[derive(FromBytes)] only supports structs") };
     };
     let (impl_generics, ty_generics, base_where_clause) = input.generics.split_for_impl();
     let name = input.ident;
-    let trait_ = parse_quote! { ::kernel::transmute::FromBytes };
+    let trait_ = parse_quote! { ::#crate_::transmute::FromBytes };
     let mut where_clause = all_fields_impl(&ds.fields, &trait_);
     if let Some(base_clause) = base_where_clause {
         where_clause
diff --git a/rust/traits/lib.rs b/rust/traits/lib.rs
new file mode 100644
index 0000000000000000000000000000000000000000..33020a17333521b3bee71bd3d003a759ac97fedd
--- /dev/null
+++ b/rust/traits/lib.rs
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0
+
+//! Support crate containing traits and other definitions that need to be available without the
+//! kernel crate. The usual case for this is code that needs to be available in the bindings crate.
+#![no_std]
+pub mod transmute;
diff --git a/rust/kernel/transmute.rs b/rust/traits/transmute.rs
similarity index 100%
rename from rust/kernel/transmute.rs
rename to rust/traits/transmute.rs
diff --git a/rust/uapi/lib.rs b/rust/uapi/lib.rs
index 1d5fd9efb93e9db97fec84fca2bae37b500c20c5..928b4b2eb035250399e3150f20b638edbf04dac1 100644
--- a/rust/uapi/lib.rs
+++ b/rust/uapi/lib.rs
@@ -34,6 +34,7 @@
 type __kernel_ssize_t = isize;
 type __kernel_ptrdiff_t = isize;
 
+use macros::{AsBytesTrait, FromBytesTrait};
 use pin_init::MaybeZeroable;
 
 include!(concat!(env!("OBJTREE"), "/rust/uapi/uapi_generated.rs"));

-- 
2.52.0.305.g3fc767764a-goog

Re: [PATCH 3/3] rust: Support deriving `AsBytes`/`FromBytes` on bindgen types

[Matthew Maurer]

On Fri, Dec 12, 2025 at 3:42 PM Matthew Maurer <mmaurer@google.com> wrote:
>
> To support this, we need to move the `transmute` module into a separate
> crate to allow the `bindings` crate to depend on it. Most user code is
> still expected to address the module as `kernel::transmute`, which is a
> re-export. `traits::transmute` is now available for use in `bindings`.
>
> Signed-off-by: Matthew Maurer <mmaurer@google.com>
> ---
>  rust/Makefile                        | 19 +++++++++++++++----
>  rust/bindgen_parameters              |  8 ++++++++
>  rust/bindings/lib.rs                 |  1 +
>  rust/kernel/lib.rs                   |  3 ++-
>  rust/macros/lib.rs                   | 24 ++++++++++++++++++++++--
>  rust/macros/transmute.rs             | 12 +++++++-----
>  rust/traits/lib.rs                   |  6 ++++++
>  rust/{kernel => traits}/transmute.rs |  0
>  rust/uapi/lib.rs                     |  1 +
>  9 files changed, 62 insertions(+), 12 deletions(-)
>
> diff --git a/rust/Makefile b/rust/Makefile
> index 5d357dce1704d15e43effc528be8f5a4d74d3d8d..bbede4b5b4faa5edeb1d33bdce338a7b76915d07 100644
> --- a/rust/Makefile
> +++ b/rust/Makefile
> @@ -660,26 +660,37 @@ $(obj)/ffi.o: private skip_gendwarfksyms = 1
>  $(obj)/ffi.o: $(src)/ffi.rs $(obj)/compiler_builtins.o FORCE
>         +$(call if_changed_rule,rustc_library)
>
> -$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init
> +$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init \
> +       --extern traits --extern macros
>  $(obj)/bindings.o: $(src)/bindings/lib.rs \
>      $(obj)/ffi.o \
>      $(obj)/pin_init.o \
> +    $(obj)/traits.o \
> +    $(obj)/$(libmacros_name) \
>      $(obj)/bindings/bindings_generated.rs \
>      $(obj)/bindings/bindings_helpers_generated.rs FORCE
>         +$(call if_changed_rule,rustc_library)
>
> -$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
> +$(obj)/traits.o: private skip_gendwarfksyms = 1
> +$(obj)/traits.o: $(src)/traits/lib.rs FORCE

I've noticed that with high parallelism on a clean build this build
rule will sometimes fail because `compiler_builtins.o` is not listed
as a dependency (I had kind of expected `rustc_library` to imply
that). I'll fix that in a v2, but figured I'd note that for anyone
trying it out in the meantime.

> +       +$(call if_changed_rule,rustc_library)
> +
> +
> +$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
> +       --extern traits --extern macros
>  $(obj)/uapi.o: private skip_gendwarfksyms = 1
>  $(obj)/uapi.o: $(src)/uapi/lib.rs \
>      $(obj)/ffi.o \
>      $(obj)/pin_init.o \
> +    $(obj)/traits.o \
> +    $(obj)/$(libmacros_name) \
>      $(obj)/uapi/uapi_generated.rs FORCE
>         +$(call if_changed_rule,rustc_library)
>
>  $(obj)/kernel.o: private rustc_target_flags = --extern ffi --extern pin_init \
> -    --extern build_error --extern macros --extern bindings --extern uapi
> +    --extern build_error --extern macros --extern bindings --extern uapi --extern traits
>  $(obj)/kernel.o: $(src)/kernel/lib.rs $(obj)/build_error.o $(obj)/pin_init.o \
> -    $(obj)/$(libmacros_name) $(obj)/bindings.o $(obj)/uapi.o FORCE
> +    $(obj)/$(libmacros_name) $(obj)/bindings.o $(obj)/uapi.o $(obj)/traits.o FORCE
>         +$(call if_changed_rule,rustc_library)
>
>  ifdef CONFIG_JUMP_LABEL
> diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> index fd2fd1c3cb9a51ea46fcd721907783b457aa1378..60910ba8731180516b4980b9e0dc5fb0c297da55 100644
> --- a/rust/bindgen_parameters
> +++ b/rust/bindgen_parameters
> @@ -64,3 +64,11 @@
>  # Structs should implement `Zeroable` when all of their fields do.
>  --with-derive-custom-struct .*=MaybeZeroable
>  --with-derive-custom-union .*=MaybeZeroable
> +
> +# Every C struct can try to derive FromBytes. If they have unmet requirements,
> +# the impl will just be a no-op due to the where clause.
> +--with-derive-custom-struct .*=FromBytesTrait
> +
> +# We can't auto-derive AsBytes, as we need a const-time check to see if there
> +# is padding involved. Add it explicitly when you expect no padding.
> +--with-derive-custom-struct cpumask=AsBytesTrait
> diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
> index 0c57cf9b4004f176997c59ecc58a9a9ac76163d9..07932ab130c0a8e56e35d49ace77ae1becc09ae6 100644
> --- a/rust/bindings/lib.rs
> +++ b/rust/bindings/lib.rs
> @@ -31,6 +31,7 @@
>  #[allow(clippy::undocumented_unsafe_blocks)]
>  #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
>  mod bindings_raw {
> +    use macros::{AsBytesTrait, FromBytesTrait};
>      use pin_init::{MaybeZeroable, Zeroable};
>
>      // Manual definition for blocklisted types.
> diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
> index f812cf12004286962985a068665443dc22c389a2..8c605f4905223077f5d824f27220c4c24e71d5f4 100644
> --- a/rust/kernel/lib.rs
> +++ b/rust/kernel/lib.rs
> @@ -146,7 +146,6 @@
>  pub mod task;
>  pub mod time;
>  pub mod tracepoint;
> -pub mod transmute;
>  pub mod types;
>  pub mod uaccess;
>  #[cfg(CONFIG_USB = "y")]
> @@ -159,6 +158,8 @@
>  pub use macros;
>  pub use uapi;
>
> +pub use traits::*;
> +
>  /// Prefix to appear before log messages printed from within the `kernel` crate.
>  const __LOG_PREFIX: &[u8] = b"rust_kernel\0";
>
> diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
> index cec8bd3a742b3f6b3680c4286f73c8fa550a58a0..862de56339bbb18cd30a260444dc19f24b13a0d0 100644
> --- a/rust/macros/lib.rs
> +++ b/rust/macros/lib.rs
> @@ -503,7 +503,7 @@ pub fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
>  #[proc_macro_derive(FromBytes)]
>  pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
>      let input = parse_macro_input!(tokens as DeriveInput);
> -    transmute::from_bytes(input).into()
> +    transmute::from_bytes("kernel", input).into()
>  }
>
>  /// Implements `AsBytes` for a struct.
> @@ -533,5 +533,25 @@ pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
>  #[proc_macro_derive(AsBytes)]
>  pub fn derive_as_bytes(tokens: TokenStream) -> TokenStream {
>      let input = parse_macro_input!(tokens as DeriveInput);
> -    transmute::as_bytes(input).into()
> +    transmute::as_bytes("kernel", input).into()
> +}
> +
> +#[doc(hidden)]
> +#[proc_macro_derive(FromBytesTrait)]
> +/// This is equivalent to `FromBytes`, but uses the `trait` crate as the trait definition site
> +/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
> +/// trait through `kernel`.
> +pub fn derive_from_bytes_trait(tokens: TokenStream) -> TokenStream {
> +    let input = parse_macro_input!(tokens as DeriveInput);
> +    transmute::from_bytes("traits", input).into()
> +}
> +
> +#[doc(hidden)]
> +#[proc_macro_derive(AsBytesTrait)]
> +/// This is equivalent to `AsBytes`, but uses the `trait` crate as the trait definition site
> +/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
> +/// trait through `kernel`.
> +pub fn derive_as_bytes_trait(tokens: TokenStream) -> TokenStream {
> +    let input = parse_macro_input!(tokens as DeriveInput);
> +    transmute::as_bytes("traits", input).into()
>  }
> diff --git a/rust/macros/transmute.rs b/rust/macros/transmute.rs
> index 43cf36a1334f1fed23c0e777026392f987f78d8d..9bd6d279675fb1d58cdceff1f4dde0dcf33fbf99 100644
> --- a/rust/macros/transmute.rs
> +++ b/rust/macros/transmute.rs
> @@ -1,6 +1,6 @@
>  // SPDX-License-Identifier: GPL-2.0
>
> -use proc_macro2::TokenStream;
> +use proc_macro2::{Span, TokenStream};
>  use syn::{parse_quote, DeriveInput, Fields, Ident, ItemConst, Path, WhereClause};
>
>  fn all_fields_impl(fields: &Fields, trait_: &Path) -> WhereClause {
> @@ -19,7 +19,8 @@ fn struct_padding_check(fields: &Fields, name: &Ident) -> ItemConst {
>      }
>  }
>
> -pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
> +pub(crate) fn as_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
> +    let crate_ = Ident::new(crate_, Span::call_site());
>      if !input.generics.params.is_empty() {
>          return quote::quote! { compile_error!("#[derive(AsBytes)] does not support generics") };
>      }
> @@ -27,7 +28,7 @@ pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
>          return quote::quote! { compile_error!("#[derive(AsBytes)] only supports structs") };
>      };
>      let name = input.ident;
> -    let trait_ = parse_quote! { ::kernel::transmute::AsBytes };
> +    let trait_ = parse_quote! { ::#crate_::transmute::AsBytes };
>      let where_clause = all_fields_impl(&ds.fields, &trait_);
>      let padding_check = struct_padding_check(&ds.fields, &name);
>      quote::quote! {
> @@ -37,13 +38,14 @@ unsafe impl #trait_ for #name #where_clause {}
>      }
>  }
>
> -pub(crate) fn from_bytes(input: DeriveInput) -> TokenStream {
> +pub(crate) fn from_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
> +    let crate_ = Ident::new(crate_, Span::call_site());
>      let syn::Data::Struct(ref ds) = &input.data else {
>          return quote::quote! { compile_error!("#[derive(FromBytes)] only supports structs") };
>      };
>      let (impl_generics, ty_generics, base_where_clause) = input.generics.split_for_impl();
>      let name = input.ident;
> -    let trait_ = parse_quote! { ::kernel::transmute::FromBytes };
> +    let trait_ = parse_quote! { ::#crate_::transmute::FromBytes };
>      let mut where_clause = all_fields_impl(&ds.fields, &trait_);
>      if let Some(base_clause) = base_where_clause {
>          where_clause
> diff --git a/rust/traits/lib.rs b/rust/traits/lib.rs
> new file mode 100644
> index 0000000000000000000000000000000000000000..33020a17333521b3bee71bd3d003a759ac97fedd
> --- /dev/null
> +++ b/rust/traits/lib.rs
> @@ -0,0 +1,6 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +//! Support crate containing traits and other definitions that need to be available without the
> +//! kernel crate. The usual case for this is code that needs to be available in the bindings crate.
> +#![no_std]
> +pub mod transmute;
> diff --git a/rust/kernel/transmute.rs b/rust/traits/transmute.rs
> similarity index 100%
> rename from rust/kernel/transmute.rs
> rename to rust/traits/transmute.rs
> diff --git a/rust/uapi/lib.rs b/rust/uapi/lib.rs
> index 1d5fd9efb93e9db97fec84fca2bae37b500c20c5..928b4b2eb035250399e3150f20b638edbf04dac1 100644
> --- a/rust/uapi/lib.rs
> +++ b/rust/uapi/lib.rs
> @@ -34,6 +34,7 @@
>  type __kernel_ssize_t = isize;
>  type __kernel_ptrdiff_t = isize;
>
> +use macros::{AsBytesTrait, FromBytesTrait};
>  use pin_init::MaybeZeroable;
>
>  include!(concat!(env!("OBJTREE"), "/rust/uapi/uapi_generated.rs"));
>
> --
> 2.52.0.305.g3fc767764a-goog
>

Re: [PATCH 3/3] rust: Support deriving `AsBytes`/`FromBytes` on bindgen types

[kernel test robot]

Hi Matthew,

kernel test robot noticed the following build errors:

[auto build test ERROR on 008d3547aae5bc86fac3eda317489169c3fda112]

url:    https://github.com/intel-lab-lkp/linux/commits/Matthew-Maurer/rust-transmute-Support-transmuting-slices-of-AsBytes-FromBytes-types/20251213-074604
base:   008d3547aae5bc86fac3eda317489169c3fda112
patch link:    https://lore.kernel.org/r/20251212-transmute-v1-3-9b28e06c6508%40google.com
patch subject: [PATCH 3/3] rust: Support deriving `AsBytes`/`FromBytes` on bindgen types
config: x86_64-rhel-9.4-rust (https://download.01.org/0day-ci/archive/20251214/202512141048.FYhaUWwX-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
rustc: rustc 1.88.0 (6b00bc388 2025-06-23)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251214/202512141048.FYhaUWwX-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512141048.FYhaUWwX-lkp@intel.com/

All errors (new ones prefixed by >>):

>> error[E0463]: can't find crate for `core`
   |
   = note: the `target` target may not be installed
   = help: consider downloading the target with `rustup target add target`
   = help: consider building the standard library from source with `cargo build -Zbuild-std`

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki