From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-244106.protonmail.ch (mail-244106.protonmail.ch [109.224.244.106]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47DF2390239; Tue, 23 Jun 2026 17:58:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=109.224.244.106 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782237510; cv=none; b=XCNUf+9AryKvQ65cDdNIBz4zqk24zLVFUVzRxQ5ZltbR7tcr4ZyZpJ0HMZHYAwkVMsAKICZhEQQuulZh/9n7ebYPizAa2V9Rp15JRLzhu7mSNf9CaN33g+5mTCpQ+XsAR68+xNHrVx7ajhcNg7NvfJCWY5+anlrtzT/jQrAH6Xc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782237510; c=relaxed/simple; bh=76/1GUAN5nAhQcqGvqLi31BGi0RSs8jcmaXB/WwXzsA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dxmQGjrsQca+2xE6IvItPfQGV+tAvHtrHuNZNagxfZXJj/fkaWcCPhddbG9GKDv2CN3kyT+Vypd2/3xFW/jn4e7s7p44EptpX0rhxbRPDFxuPD8tHUWvAnt6rnhaAS0UW0gkl8rOFr6HP3IWIOiSpXnJHNitaIUTj1rMEJpQCh0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=onurozkan.dev; spf=pass smtp.mailfrom=onurozkan.dev; dkim=pass (2048-bit key) header.d=onurozkan.dev header.i=@onurozkan.dev header.b=uEi1UEvY; arc=none smtp.client-ip=109.224.244.106 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=onurozkan.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=onurozkan.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=onurozkan.dev header.i=@onurozkan.dev header.b="uEi1UEvY" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=onurozkan.dev; s=protonmail; t=1782237501; x=1782496701; bh=NQAXQdG5qVz4Vmp2WE4VxYYEzss5eGUVVkScbW2/IOw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:From:To: Cc:Date:Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=uEi1UEvYm96DHhDZgRaUYCtMDz7zDeNTc38JITfU3tyd2yMhvbTBlM59uHoX6B7hm 88dp/ZfIn81dcAcLnELixo5ytEit2z8yqFKPih3tYK1YE7kL/MFNx6xlqZ0Dt+k968 aqHiPBDGVdy4BXCDNEmnmaT8crPuOv4zEoKZ44RSarEhzknC7S5nrSjuqEvBNjV1Uv cl1J91nwTBqPaMbzjevRBlXY3ntAiJNP+i4isFM1jusUOhQgu+EwYfWR6fsOH2szwj 3UNATy+gf4TIj3SaqryMYDmQDg1K5TumvK6MXxURwoqr530dtrKA4GWZww4TMMp1Kp IBgX6Hrg74GWA== X-Pm-Submission-Id: 4glCTz3ZzJz2Sd45 From: =?UTF-8?q?Onur=20=C3=96zkan?= To: Andreas Hindborg Cc: Miguel Ojeda , Gary Guo , =?utf-8?q?Bj=C3=B6rn_Roy_Baron?= , Benno Lossin , Alice Ryhl , Trevor Gross , Danilo Krummrich , Greg Kroah-Hartman , Dave Ertman , Ira Weiny , Leon Romanovsky , Paul Moore , Serge Hallyn , "Rafael J. Wysocki" , David Airlie , Simona Vetter , Alexander Viro , Christian Brauner , Jan Kara , Daniel Almeida , Viresh Kumar , Nishanth Menon , Stephen Boyd , Bjorn Helgaas , =?utf-8?q?Krzysztof_Wilczy=C5=84ski?= , Boqun Feng , Uladzislau Rezki , Lorenzo Stoakes , Vlastimil Babka , "Liam R. Howlett" , Igor Korotin , Pavel Tikhomirov , linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, linux-block@vger.kernel.org, linux-security-module@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-pm@vger.kernel.org, linux-pci@vger.kernel.org, driver-core@lists.linux.dev, Oliver Mangold , Viresh Kumar Subject: Re: [PATCH v17 06/10] rust: rename `AlwaysRefCounted` to `RefCounted`. Date: Tue, 23 Jun 2026 20:58:12 +0300 Message-ID: <20260623175814.87191-1-work@onurozkan.dev> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20260604-unique-ref-v17-6-7b4c3d2930b9@kernel.org> References: <20260604-unique-ref-v17-0-7b4c3d2930b9@kernel.org> <20260604-unique-ref-v17-6-7b4c3d2930b9@kernel.org> Precedence: bulk X-Mailing-List: rust-for-linux@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, 04 Jun 2026 22:11:18 +0200=0D Andreas Hindborg wrote:=0D =0D > From: Oliver Mangold =0D > =0D > There are types where it may both be reference counted in some cases and= =0D > owned in others. In such cases, obtaining `ARef` from `&T` would be=0D > unsound as it allows creation of `ARef` copy from `&Owned`.=0D > =0D > Therefore, we split `AlwaysRefCounted` into `RefCounted` (which `ARef`= =0D > would require) and a marker trait to indicate that the type is always=0D > reference counted (and not `Ownable`) so the `&T` -> `ARef` conversion= =0D > is possible.=0D > =0D > - Rename `AlwaysRefCounted` to `RefCounted`.=0D > - Add a new unsafe trait `AlwaysRefCounted`.=0D > - Implement the new trait `AlwaysRefCounted` for the newly renamed=0D > `RefCounted` implementations. This leaves functionality of existing=0D > implementers of `AlwaysRefCounted` intact.=0D > =0D > Suggested-by: Alice Ryhl =0D > Reviewed-by: Daniel Almeida =0D > Signed-off-by: Oliver Mangold =0D > [ Andreas: Updated commit message and rebase on rust-6.20-7.0 ]=0D > Acked-by: Igor Korotin =0D > Acked-by: Danilo Krummrich =0D > Acked-by: Viresh Kumar =0D > Reviewed-by: Gary Guo =0D > Co-developed-by: Andreas Hindborg =0D > Signed-off-by: Andreas Hindborg =0D > ---=0D > rust/kernel/auxiliary.rs | 7 +++++-=0D > rust/kernel/block/mq/request.rs | 15 ++++++++-----=0D > rust/kernel/cred.rs | 13 +++++++++--=0D > rust/kernel/device.rs | 12 ++++++++--=0D > rust/kernel/device/property.rs | 11 +++++++--=0D > rust/kernel/drm/device.rs | 9 ++++++--=0D > rust/kernel/drm/gem/mod.rs | 16 ++++++++++----=0D > rust/kernel/fs/file.rs | 16 ++++++++++----=0D > rust/kernel/i2c.rs | 13 ++++++++---=0D > rust/kernel/mm.rs | 15 +++++++++----=0D > rust/kernel/mm/mmput_async.rs | 9 ++++++--=0D > rust/kernel/opp.rs | 10 ++++++---=0D > rust/kernel/owned.rs | 2 +-=0D > rust/kernel/pci.rs | 10 ++++++++-=0D > rust/kernel/pid_namespace.rs | 12 ++++++++--=0D > rust/kernel/platform.rs | 7 +++++-=0D > rust/kernel/sync/aref.rs | 49 ++++++++++++++++++++++++++---------= ------=0D > rust/kernel/task.rs | 13 +++++++++--=0D > rust/kernel/types.rs | 3 ++-=0D > rust/kernel/usb.rs | 17 +++++++++++---=0D > 20 files changed, 195 insertions(+), 64 deletions(-)=0D > =0D > diff --git a/rust/kernel/auxiliary.rs b/rust/kernel/auxiliary.rs=0D > index 93c0db1f6655..49f07740f657 100644=0D > --- a/rust/kernel/auxiliary.rs=0D > +++ b/rust/kernel/auxiliary.rs=0D > @@ -19,6 +19,7 @@=0D > to_result, //=0D > },=0D > prelude::*,=0D > + sync::aref::{AlwaysRefCounted, RefCounted},=0D =0D This patch has multiple horizontal use statements around.=0D =0D Onur=0D =0D > types::Opaque,=0D > ThisModule, //=0D > };=0D > @@ -289,7 +290,7 @@ unsafe impl device::AsBus= Device for Device=0D > kernel::impl_device_context_into_aref!(Device);=0D > =0D > // SAFETY: Instances of `Device` are always reference-counted.=0D > -unsafe impl crate::sync::aref::AlwaysRefCounted for Device {=0D > +unsafe impl RefCounted for Device {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::get_device(self.as_ref().as_raw()) };=0D > @@ -308,6 +309,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Device`.=0D > +unsafe impl AlwaysRefCounted for Device {}=0D > +=0D > impl AsRef> for Device {=0D > fn as_ref(&self) -> &device::Device {=0D > // SAFETY: By the type invariant of `Self`, `self.as_raw()` is a= pointer to a valid=0D > diff --git a/rust/kernel/block/mq/request.rs b/rust/kernel/block/mq/reque= st.rs=0D > index ce3e30c81cb5..cf013b9e2cac 100644=0D > --- a/rust/kernel/block/mq/request.rs=0D > +++ b/rust/kernel/block/mq/request.rs=0D > @@ -9,7 +9,7 @@=0D > block::mq::Operations,=0D > error::Result,=0D > sync::{=0D > - aref::{ARef, AlwaysRefCounted},=0D > + aref::{ARef, AlwaysRefCounted, RefCounted},=0D > atomic::Relaxed,=0D > Refcount,=0D > },=0D > @@ -229,11 +229,10 @@ unsafe impl Send for Request {}=0D > // mutate `self` are internally synchronized`=0D > unsafe impl Sync for Request {}=0D > =0D > -// SAFETY: All instances of `Request` are reference counted. This=0D > -// implementation of `AlwaysRefCounted` ensure that increments to the re= f count=0D > -// keeps the object alive in memory at least until a matching reference = count=0D > -// decrement is executed.=0D > -unsafe impl AlwaysRefCounted for Request {=0D > +// SAFETY: All instances of `Request` are reference counted. This imp= lementation of `RefCounted`=0D > +// ensure that increments to the ref count keeps the object alive in mem= ory at least until a=0D > +// matching reference count decrement is executed.=0D > +unsafe impl RefCounted for Request {=0D > fn inc_ref(&self) {=0D > self.wrapper_ref().refcount().inc();=0D > }=0D > @@ -255,3 +254,7 @@ unsafe fn dec_ref(obj: core::ptr::NonNull) {=0D > }=0D > }=0D > }=0D > +=0D > +// SAFETY: We currently do not implement `Ownable`, thus it is okay to o= btain an `ARef`=0D > +// from a `&Request` (but this will change in the future).=0D > +unsafe impl AlwaysRefCounted for Request {}=0D > diff --git a/rust/kernel/cred.rs b/rust/kernel/cred.rs=0D > index ffa156b9df37..20ef0144094b 100644=0D > --- a/rust/kernel/cred.rs=0D > +++ b/rust/kernel/cred.rs=0D > @@ -8,7 +8,12 @@=0D > //!=0D > //! Reference: =0D > =0D > -use crate::{bindings, sync::aref::AlwaysRefCounted, task::Kuid, types::O= paque};=0D > +use crate::{=0D > + bindings,=0D > + sync::aref::RefCounted,=0D > + task::Kuid,=0D > + types::{AlwaysRefCounted, Opaque},=0D > +};=0D > =0D > /// Wraps the kernel's `struct cred`.=0D > ///=0D > @@ -76,7 +81,7 @@ pub fn euid(&self) -> Kuid {=0D > }=0D > =0D > // SAFETY: The type invariants guarantee that `Credential` is always ref= -counted.=0D > -unsafe impl AlwaysRefCounted for Credential {=0D > +unsafe impl RefCounted for Credential {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference means that the re= fcount is nonzero.=0D > @@ -90,3 +95,7 @@ unsafe fn dec_ref(obj: core::ptr::NonNull) = {=0D > unsafe { bindings::put_cred(obj.cast().as_ptr()) };=0D > }=0D > }=0D > +=0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Credential`.=0D > +unsafe impl AlwaysRefCounted for Credential {}=0D > diff --git a/rust/kernel/device.rs b/rust/kernel/device.rs=0D > index 6d5396a43ebe..efdf33617d12 100644=0D > --- a/rust/kernel/device.rs=0D > +++ b/rust/kernel/device.rs=0D > @@ -8,8 +8,12 @@=0D > bindings,=0D > fmt,=0D > prelude::*,=0D > - sync::aref::ARef,=0D > + sync::aref::{=0D > + ARef,=0D > + RefCounted, //=0D > + },=0D > types::{=0D > + AlwaysRefCounted,=0D > ForeignOwnable,=0D > Opaque, //=0D > }, //=0D > @@ -508,7 +512,7 @@ pub fn name(&self) -> &CStr {=0D > kernel::impl_device_context_into_aref!(Device);=0D > =0D > // SAFETY: Instances of `Device` are always reference-counted.=0D > -unsafe impl crate::sync::aref::AlwaysRefCounted for Device {=0D > +unsafe impl RefCounted for Device {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::get_device(self.as_raw()) };=0D > @@ -520,6 +524,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Device`.=0D > +unsafe impl AlwaysRefCounted for Device {}=0D > +=0D > // SAFETY: As by the type invariant `Device` can be sent to any thread.= =0D > unsafe impl Send for Device {}=0D > =0D > diff --git a/rust/kernel/device/property.rs b/rust/kernel/device/property= .rs=0D > index 5aead835fbbc..cee7e2501368 100644=0D > --- a/rust/kernel/device/property.rs=0D > +++ b/rust/kernel/device/property.rs=0D > @@ -14,7 +14,10 @@=0D > fmt,=0D > prelude::*,=0D > str::{CStr, CString},=0D > - sync::aref::ARef,=0D > + sync::aref::{=0D > + ARef,=0D > + AlwaysRefCounted, //=0D > + },=0D > types::Opaque,=0D > };=0D > =0D > @@ -360,7 +363,7 @@ fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Res= ult {=0D > }=0D > =0D > // SAFETY: Instances of `FwNode` are always reference-counted.=0D > -unsafe impl crate::sync::aref::AlwaysRefCounted for FwNode {=0D > +unsafe impl crate::sync::aref::RefCounted for FwNode {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he=0D > // refcount is non-zero.=0D > @@ -374,6 +377,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&FwNode`.=0D > +unsafe impl AlwaysRefCounted for FwNode {}=0D > +=0D > enum Node<'a> {=0D > Borrowed(&'a FwNode),=0D > Owned(ARef),=0D > diff --git a/rust/kernel/drm/device.rs b/rust/kernel/drm/device.rs=0D > index adbafe8db54d..a5a040266aae 100644=0D > --- a/rust/kernel/drm/device.rs=0D > +++ b/rust/kernel/drm/device.rs=0D > @@ -15,7 +15,8 @@=0D > prelude::*,=0D > sync::aref::{=0D > ARef,=0D > - AlwaysRefCounted, //=0D > + AlwaysRefCounted,=0D > + RefCounted, //=0D > },=0D > types::Opaque,=0D > workqueue::{=0D > @@ -217,7 +218,7 @@ fn deref(&self) -> &Self::Target {=0D > =0D > // SAFETY: DRM device objects are always reference counted and the get/p= ut functions=0D > // satisfy the requirements.=0D > -unsafe impl AlwaysRefCounted for Device {=0D > +unsafe impl RefCounted for Device {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::drm_dev_get(self.as_raw()) };=0D > @@ -232,6 +233,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Device`.=0D > +unsafe impl AlwaysRefCounted for Device {}=0D > +=0D > impl AsRef for Device {=0D > fn as_ref(&self) -> &device::Device {=0D > // SAFETY: `bindings::drm_device::dev` is valid as long as the D= RM device itself is valid,=0D > diff --git a/rust/kernel/drm/gem/mod.rs b/rust/kernel/drm/gem/mod.rs=0D > index 75acda7ba500..f8cc2a0ff4c7 100644=0D > --- a/rust/kernel/drm/gem/mod.rs=0D > +++ b/rust/kernel/drm/gem/mod.rs=0D > @@ -17,7 +17,7 @@=0D > prelude::*,=0D > sync::aref::{=0D > ARef,=0D > - AlwaysRefCounted, //=0D > + RefCounted, //=0D > },=0D > types::Opaque,=0D > };=0D > @@ -29,7 +29,7 @@=0D > #[cfg(CONFIG_RUST_DRM_GEM_SHMEM_HELPER)]=0D > pub mod shmem;=0D > =0D > -/// A macro for implementing [`AlwaysRefCounted`] for any GEM object typ= e.=0D > +/// A macro for implementing [`RefCounted`] for any GEM object type.=0D > ///=0D > /// Since all GEM objects use the same refcounting scheme.=0D > #[macro_export]=0D > @@ -42,7 +42,7 @@ impl $( <$( $tparam_id:ident ),+> )? for $type:ty=0D > )?=0D > ) =3D> {=0D > // SAFETY: All GEM objects are refcounted.=0D > - unsafe impl $( <$( $tparam_id ),+> )? $crate::sync::aref::Always= RefCounted for $type=0D > + unsafe impl $( <$( $tparam_id ),+> )? $crate::sync::aref::RefCou= nted for $type=0D > where=0D > Self: IntoGEMObject,=0D > $( $( $bind_param : $bind_trait ),+ )?=0D > @@ -61,6 +61,14 @@ unsafe fn dec_ref(obj: core::ptr::NonNull) {=0D > unsafe { bindings::drm_gem_object_put(obj) };=0D > }=0D > }=0D > +=0D > + // SAFETY: We do not implement `Ownable`, thus it is okay to obt= ain an `ARef<$type>` from a=0D > + // `&$type`.=0D > + unsafe impl $( <$( $tparam_id ),+> )? $crate::sync::aref::Always= RefCounted for $type=0D > + where=0D > + Self: IntoGEMObject,=0D > + $( $( $bind_param : $bind_trait ),+ )?=0D > + {}=0D > };=0D > }=0D > #[cfg_attr(not(CONFIG_RUST_DRM_GEM_SHMEM_HELPER), allow(unused))]=0D > @@ -98,7 +106,7 @@ fn close(_obj: &::Object,= _file: &DriverFile)=0D > }=0D > =0D > /// Trait that represents a GEM object subtype=0D > -pub trait IntoGEMObject: Sized + super::private::Sealed + AlwaysRefCount= ed {=0D > +pub trait IntoGEMObject: Sized + super::private::Sealed + RefCounted {=0D > /// Returns a reference to the raw `drm_gem_object` structure, which= must be valid as long as=0D > /// this owning object is valid.=0D > fn as_raw(&self) -> *mut bindings::drm_gem_object;=0D > diff --git a/rust/kernel/fs/file.rs b/rust/kernel/fs/file.rs=0D > index 23ee689bd240..06e457d62a93 100644=0D > --- a/rust/kernel/fs/file.rs=0D > +++ b/rust/kernel/fs/file.rs=0D > @@ -12,8 +12,8 @@=0D > cred::Credential,=0D > error::{code::*, to_result, Error, Result},=0D > fmt,=0D > - sync::aref::{ARef, AlwaysRefCounted},=0D > - types::{NotThreadSafe, Opaque},=0D > + sync::aref::RefCounted,=0D > + types::{ARef, AlwaysRefCounted, NotThreadSafe, Opaque},=0D > };=0D > use core::ptr;=0D > =0D > @@ -197,7 +197,7 @@ unsafe impl Sync for File {}=0D > =0D > // SAFETY: The type invariants guarantee that `File` is always ref-count= ed. This implementation=0D > // makes `ARef` own a normal refcount.=0D > -unsafe impl AlwaysRefCounted for File {=0D > +unsafe impl RefCounted for File {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference means that the re= fcount is nonzero.=0D > @@ -212,6 +212,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&File`.=0D > +unsafe impl AlwaysRefCounted for File {}=0D > +=0D > /// Wraps the kernel's `struct file`. Not thread safe.=0D > ///=0D > /// This type represents a file that is not known to be safe to transfer= across thread boundaries.=0D > @@ -233,7 +237,7 @@ pub struct LocalFile {=0D > =0D > // SAFETY: The type invariants guarantee that `LocalFile` is always ref-= counted. This implementation=0D > // makes `ARef` own a normal refcount.=0D > -unsafe impl AlwaysRefCounted for LocalFile {=0D > +unsafe impl RefCounted for LocalFile {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference means that the re= fcount is nonzero.=0D > @@ -249,6 +253,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&LocalFile`.=0D > +unsafe impl AlwaysRefCounted for LocalFile {}=0D > +=0D > impl LocalFile {=0D > /// Constructs a new `struct file` wrapper from a file descriptor.=0D > ///=0D > diff --git a/rust/kernel/i2c.rs b/rust/kernel/i2c.rs=0D > index 7b908f0c5a58..56791c1d63d7 100644=0D > --- a/rust/kernel/i2c.rs=0D > +++ b/rust/kernel/i2c.rs=0D > @@ -18,7 +18,8 @@=0D > prelude::*,=0D > sync::aref::{=0D > ARef,=0D > - AlwaysRefCounted, //=0D > + AlwaysRefCounted,=0D > + RefCounted, //=0D > },=0D > types::Opaque, //=0D > };=0D > @@ -415,7 +416,7 @@ pub fn get(index: i32) -> Result> {=0D > kernel::impl_device_context_into_aref!(I2cAdapter);=0D > =0D > // SAFETY: Instances of `I2cAdapter` are always reference-counted.=0D > -unsafe impl AlwaysRefCounted for I2cAdapter {=0D > +unsafe impl RefCounted for I2cAdapter {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::i2c_get_adapter(self.index()) };=0D > @@ -426,6 +427,9 @@ unsafe fn dec_ref(obj: NonNull) {=0D > unsafe { bindings::i2c_put_adapter(obj.as_ref().as_raw()) }=0D > }=0D > }=0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from an=0D > +// `&I2cAdapter`.=0D > +unsafe impl AlwaysRefCounted for I2cAdapter {}=0D > =0D > /// The i2c board info representation=0D > ///=0D > @@ -491,7 +495,7 @@ unsafe impl device::AsBus= Device for I2cClient kernel::impl_device_context_into_aref!(I2cClient);=0D > =0D > // SAFETY: Instances of `I2cClient` are always reference-counted.=0D > -unsafe impl AlwaysRefCounted for I2cClient {=0D > +unsafe impl RefCounted for I2cClient {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::get_device(self.as_ref().as_raw()) };=0D > @@ -502,6 +506,9 @@ unsafe fn dec_ref(obj: NonNull) {=0D > unsafe { bindings::put_device(&raw mut (*obj.as_ref().as_raw()).= dev) }=0D > }=0D > }=0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from an=0D > +// `&I2cClient`.=0D > +unsafe impl AlwaysRefCounted for I2cClient {}=0D > =0D > impl AsRef> for I2cClien= t {=0D > fn as_ref(&self) -> &device::Device {=0D > diff --git a/rust/kernel/mm.rs b/rust/kernel/mm.rs=0D > index 4764d7b68f2a..dd9e3969e720 100644=0D > --- a/rust/kernel/mm.rs=0D > +++ b/rust/kernel/mm.rs=0D > @@ -13,8 +13,8 @@=0D > =0D > use crate::{=0D > bindings,=0D > - sync::aref::{ARef, AlwaysRefCounted},=0D > - types::{NotThreadSafe, Opaque},=0D > + sync::aref::RefCounted,=0D > + types::{ARef, AlwaysRefCounted, NotThreadSafe, Opaque},=0D > };=0D > use core::{ops::Deref, ptr::NonNull};=0D > =0D > @@ -55,7 +55,7 @@ unsafe impl Send for Mm {}=0D > unsafe impl Sync for Mm {}=0D > =0D > // SAFETY: By the type invariants, this type is always refcounted.=0D > -unsafe impl AlwaysRefCounted for Mm {=0D > +unsafe impl RefCounted for Mm {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The pointer is valid since self is a reference.=0D > @@ -69,6 +69,9 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a `&Mm`.=0D > +unsafe impl AlwaysRefCounted for Mm {}=0D > +=0D > /// A wrapper for the kernel's `struct mm_struct`.=0D > ///=0D > /// This type is like [`Mm`], but with non-zero `mm_users`. It can only = be used when `mm_users` can=0D > @@ -91,7 +94,7 @@ unsafe impl Send for MmWithUser {}=0D > unsafe impl Sync for MmWithUser {}=0D > =0D > // SAFETY: By the type invariants, this type is always refcounted.=0D > -unsafe impl AlwaysRefCounted for MmWithUser {=0D > +unsafe impl RefCounted for MmWithUser {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The pointer is valid since self is a reference.=0D > @@ -105,6 +108,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&MmWithUser`.=0D > +unsafe impl AlwaysRefCounted for MmWithUser {}=0D > +=0D > // Make all `Mm` methods available on `MmWithUser`.=0D > impl Deref for MmWithUser {=0D > type Target =3D Mm;=0D > diff --git a/rust/kernel/mm/mmput_async.rs b/rust/kernel/mm/mmput_async.r= s=0D > index b8d2f051225c..aba4ce675c86 100644=0D > --- a/rust/kernel/mm/mmput_async.rs=0D > +++ b/rust/kernel/mm/mmput_async.rs=0D > @@ -10,7 +10,8 @@=0D > use crate::{=0D > bindings,=0D > mm::MmWithUser,=0D > - sync::aref::{ARef, AlwaysRefCounted},=0D > + sync::aref::RefCounted,=0D > + types::{ARef, AlwaysRefCounted},=0D > };=0D > use core::{ops::Deref, ptr::NonNull};=0D > =0D > @@ -34,7 +35,7 @@ unsafe impl Send for MmWithUserAsync {}=0D > unsafe impl Sync for MmWithUserAsync {}=0D > =0D > // SAFETY: By the type invariants, this type is always refcounted.=0D > -unsafe impl AlwaysRefCounted for MmWithUserAsync {=0D > +unsafe impl RefCounted for MmWithUserAsync {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The pointer is valid since self is a reference.=0D > @@ -48,6 +49,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef`=0D > +// from a `&MmWithUserAsync`.=0D > +unsafe impl AlwaysRefCounted for MmWithUserAsync {}=0D > +=0D > // Make all `MmWithUser` methods available on `MmWithUserAsync`.=0D > impl Deref for MmWithUserAsync {=0D > type Target =3D MmWithUser;=0D > diff --git a/rust/kernel/opp.rs b/rust/kernel/opp.rs=0D > index a760fac28765..06fe2ca776a4 100644=0D > --- a/rust/kernel/opp.rs=0D > +++ b/rust/kernel/opp.rs=0D > @@ -16,8 +16,8 @@=0D > ffi::{c_char, c_ulong},=0D > prelude::*,=0D > str::CString,=0D > - sync::aref::{ARef, AlwaysRefCounted},=0D > - types::Opaque,=0D > + sync::aref::RefCounted,=0D > + types::{ARef, AlwaysRefCounted, Opaque},=0D > };=0D > =0D > #[cfg(CONFIG_CPU_FREQ)]=0D > @@ -1041,7 +1041,7 @@ unsafe impl Send for OPP {}=0D > unsafe impl Sync for OPP {}=0D > =0D > /// SAFETY: The type invariants guarantee that [`OPP`] is always refcoun= ted.=0D > -unsafe impl AlwaysRefCounted for OPP {=0D > +unsafe impl RefCounted for OPP {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference means that the re= fcount is nonzero.=0D > unsafe { bindings::dev_pm_opp_get(self.0.get()) };=0D > @@ -1053,6 +1053,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from an=0D > +// `&OPP`.=0D > +unsafe impl AlwaysRefCounted for OPP {}=0D > +=0D > impl OPP {=0D > /// Creates an owned reference to a [`OPP`] from a valid pointer.=0D > ///=0D > diff --git a/rust/kernel/owned.rs b/rust/kernel/owned.rs=0D > index 5eacdf327d12..bedd4fef84fa 100644=0D > --- a/rust/kernel/owned.rs=0D > +++ b/rust/kernel/owned.rs=0D > @@ -27,7 +27,7 @@=0D > ///=0D > /// Note: The underlying object is not required to provide internal refe= rence counting, because it=0D > /// represents a unique, owned reference. If reference counting (on the = Rust side) is required,=0D > -/// [`AlwaysRefCounted`](crate::types::AlwaysRefCounted) should be imple= mented.=0D > +/// [`RefCounted`](crate::types::RefCounted) should be implemented.=0D > ///=0D > /// # Examples=0D > ///=0D > diff --git a/rust/kernel/pci.rs b/rust/kernel/pci.rs=0D > index af74ddff6114..acf7384fea02 100644=0D > --- a/rust/kernel/pci.rs=0D > +++ b/rust/kernel/pci.rs=0D > @@ -19,6 +19,10 @@=0D > },=0D > prelude::*,=0D > str::CStr,=0D > + sync::aref::{=0D > + AlwaysRefCounted,=0D > + RefCounted, //=0D > + },=0D > types::Opaque,=0D > ThisModule, //=0D > };=0D > @@ -474,7 +478,7 @@ unsafe impl device::AsBus= Device for Device=0D > impl crate::dma::Device for Device {}=0D > =0D > // SAFETY: Instances of `Device` are always reference-counted.=0D > -unsafe impl crate::sync::aref::AlwaysRefCounted for Device {=0D > +unsafe impl RefCounted for Device {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::pci_dev_get(self.as_raw()) };=0D > @@ -486,6 +490,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Device`.=0D > +unsafe impl AlwaysRefCounted for Device {}=0D > +=0D > impl AsRef> for Device {=0D > fn as_ref(&self) -> &device::Device {=0D > // SAFETY: By the type invariant of `Self`, `self.as_raw()` is a= pointer to a valid=0D > diff --git a/rust/kernel/pid_namespace.rs b/rust/kernel/pid_namespace.rs= =0D > index 979a9718f153..4f6a94540e33 100644=0D > --- a/rust/kernel/pid_namespace.rs=0D > +++ b/rust/kernel/pid_namespace.rs=0D > @@ -7,7 +7,11 @@=0D > //! C header: [`include/linux/pid_namespace.h`](srctree/include/linux/pi= d_namespace.h) and=0D > //! [`include/linux/pid.h`](srctree/include/linux/pid.h)=0D > =0D > -use crate::{bindings, sync::aref::AlwaysRefCounted, types::Opaque};=0D > +use crate::{=0D > + bindings,=0D > + sync::aref::RefCounted,=0D > + types::{AlwaysRefCounted, Opaque},=0D > +};=0D > use core::ptr;=0D > =0D > /// Wraps the kernel's `struct pid_namespace`. Thread safe.=0D > @@ -41,7 +45,7 @@ pub unsafe fn from_ptr<'a>(ptr: *const bindings::pid_na= mespace) -> &'a Self {=0D > }=0D > =0D > // SAFETY: Instances of `PidNamespace` are always reference-counted.=0D > -unsafe impl AlwaysRefCounted for PidNamespace {=0D > +unsafe impl RefCounted for PidNamespace {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference means that the re= fcount is nonzero.=0D > @@ -55,6 +59,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from=0D > +// a `&PidNamespace`.=0D > +unsafe impl AlwaysRefCounted for PidNamespace {}=0D > +=0D > // SAFETY:=0D > // - `PidNamespace::dec_ref` can be called from any thread.=0D > // - It is okay to send ownership of `PidNamespace` across thread bounda= ries.=0D > diff --git a/rust/kernel/platform.rs b/rust/kernel/platform.rs=0D > index 8917d4ee499f..3c35aa94e319 100644=0D > --- a/rust/kernel/platform.rs=0D > +++ b/rust/kernel/platform.rs=0D > @@ -27,6 +27,7 @@=0D > },=0D > of,=0D > prelude::*,=0D > + sync::aref::{AlwaysRefCounted, RefCounted},=0D > types::Opaque,=0D > ThisModule, //=0D > };=0D > @@ -512,7 +513,7 @@ pub fn optional_irq_by_name(&self, name: &CStr) -> Re= sult> {=0D > impl crate::dma::Device for Device {}=0D > =0D > // SAFETY: Instances of `Device` are always reference-counted.=0D > -unsafe impl crate::sync::aref::AlwaysRefCounted for Device {=0D > +unsafe impl RefCounted for Device {=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference guarantees that t= he refcount is non-zero.=0D > unsafe { bindings::get_device(self.as_ref().as_raw()) };=0D > @@ -524,6 +525,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Device`.=0D > +unsafe impl AlwaysRefCounted for Device {}=0D > +=0D > impl AsRef> for Device {=0D > fn as_ref(&self) -> &device::Device {=0D > // SAFETY: By the type invariant of `Self`, `self.as_raw()` is a= pointer to a valid=0D > diff --git a/rust/kernel/sync/aref.rs b/rust/kernel/sync/aref.rs=0D > index 4ee5fac0e0b6..2d656f672b97 100644=0D > --- a/rust/kernel/sync/aref.rs=0D > +++ b/rust/kernel/sync/aref.rs=0D > @@ -19,11 +19,9 @@=0D > =0D > use core::{marker::PhantomData, mem::ManuallyDrop, ops::Deref, ptr::NonN= ull};=0D > =0D > -/// Types that are _always_ reference counted.=0D > +/// Types that are internally reference counted.=0D > ///=0D > /// It allows such types to define their own custom ref increment and de= crement functions.=0D > -/// Additionally, it allows users to convert from a shared reference `&T= ` to an owned reference=0D > -/// [`ARef`].=0D > ///=0D > /// This is usually implemented by wrappers to existing structures on th= e C side of the code. For=0D > /// Rust code, the recommendation is to use [`Arc`](crate::sync::Arc) to= create reference-counted=0D > @@ -40,9 +38,8 @@=0D > /// at least until matching decrements are performed.=0D > ///=0D > /// Implementers must also ensure that all instances are reference-count= ed. (Otherwise they=0D > -/// won't be able to honour the requirement that [`AlwaysRefCounted::inc= _ref`] keep the object=0D > -/// alive.)=0D > -pub unsafe trait AlwaysRefCounted {=0D > +/// won't be able to honour the requirement that [`RefCounted::inc_ref`]= keep the object alive.)=0D > +pub unsafe trait RefCounted {=0D > /// Increments the reference count on the object.=0D > fn inc_ref(&self);=0D > =0D > @@ -55,11 +52,27 @@ pub unsafe trait AlwaysRefCounted {=0D > /// Callers must ensure that there was a previous matching increment= to the reference count,=0D > /// and that the object is no longer used after its reference count = is decremented (as it may=0D > /// result in the object being freed), unless the caller owns anothe= r increment on the refcount=0D > - /// (e.g., it calls [`AlwaysRefCounted::inc_ref`] twice, then calls= =0D > - /// [`AlwaysRefCounted::dec_ref`] once).=0D > + /// (e.g., it calls [`RefCounted::inc_ref`] twice, then calls [`RefC= ounted::dec_ref`] once).=0D > unsafe fn dec_ref(obj: NonNull);=0D > }=0D > =0D > +/// Always reference-counted type.=0D > +///=0D > +/// It allows deriving a counted reference [`ARef`] from a `&T`.=0D > +///=0D > +/// This provides some convenience, but it allows "escaping" borrow chec= ks on `&T`. As it=0D > +/// complicates attempts to ensure that a reference to T is unique, it i= s optional to provide for=0D > +/// [`RefCounted`] types. See *Safety* below.=0D > +///=0D > +/// # Safety=0D > +///=0D > +/// Implementers must ensure that no safety invariants are violated by u= pgrading an `&T` to an=0D > +/// [`ARef`]. In particular that implies [`AlwaysRefCounted`] and [`c= rate::types::Ownable`]=0D > +/// cannot be implemented for the same type, as this would allow violati= ng the uniqueness guarantee=0D > +/// of [`crate::types::Owned`] by dereferencing it into an `&T` and o= btaining an [`ARef`] from=0D > +/// that.=0D > +pub unsafe trait AlwaysRefCounted: RefCounted {}=0D > +=0D > /// An owned reference to an always-reference-counted object.=0D > ///=0D > /// The object's reference count is automatically decremented when an in= stance of [`ARef`] is=0D > @@ -70,7 +83,7 @@ pub unsafe trait AlwaysRefCounted {=0D > ///=0D > /// The pointer stored in `ptr` is non-null and valid for the lifetime o= f the [`ARef`] instance. In=0D > /// particular, the [`ARef`] instance owns an increment on the underlyin= g object's reference count.=0D > -pub struct ARef {=0D > +pub struct ARef {=0D > ptr: NonNull,=0D > _p: PhantomData,=0D > }=0D > @@ -79,19 +92,19 @@ pub struct ARef {=0D > // it effectively means sharing `&T` (which is safe because `T` is `Sync= `); additionally, it needs=0D > // `T` to be `Send` because any thread that has an `ARef` may ultimat= ely access `T` using a=0D > // mutable reference, for example, when the reference count reaches zero= and `T` is dropped.=0D > -unsafe impl Send for ARef {}=0D > +unsafe impl Send for ARef {}=0D > =0D > // SAFETY: It is safe to send `&ARef` to another thread when the unde= rlying `T` is `Sync`=0D > // because it effectively means sharing `&T` (which is safe because `T` = is `Sync`); additionally,=0D > // it needs `T` to be `Send` because any thread that has a `&ARef` ma= y clone it and get an=0D > // `ARef` on that thread, so the thread may ultimately access `T` usi= ng a mutable reference, for=0D > // example, when the reference count reaches zero and `T` is dropped.=0D > -unsafe impl Sync for ARef {}=0D > +unsafe impl Sync for ARef {}=0D > =0D > // Even if `T` is pinned, pointers to `T` can still move.=0D > -impl Unpin for ARef {}=0D > +impl Unpin for ARef {}=0D > =0D > -impl ARef {=0D > +impl ARef {=0D > /// Creates a new instance of [`ARef`].=0D > ///=0D > /// It takes over an increment of the reference count on the underly= ing object.=0D > @@ -120,12 +133,12 @@ pub unsafe fn from_raw(ptr: NonNull) -> Self {=0D > ///=0D > /// ```=0D > /// use core::ptr::NonNull;=0D > - /// use kernel::sync::aref::{ARef, AlwaysRefCounted};=0D > + /// use kernel::sync::aref::{ARef, RefCounted};=0D > ///=0D > /// struct Empty {}=0D > ///=0D > /// # // SAFETY: TODO.=0D > - /// unsafe impl AlwaysRefCounted for Empty {=0D > + /// unsafe impl RefCounted for Empty {=0D > /// fn inc_ref(&self) {}=0D > /// unsafe fn dec_ref(_obj: NonNull) {}=0D > /// }=0D > @@ -143,7 +156,7 @@ pub fn into_raw(me: Self) -> NonNull {=0D > }=0D > }=0D > =0D > -impl Clone for ARef {=0D > +impl Clone for ARef {=0D > fn clone(&self) -> Self {=0D > self.inc_ref();=0D > // SAFETY: We just incremented the refcount above.=0D > @@ -151,7 +164,7 @@ fn clone(&self) -> Self {=0D > }=0D > }=0D > =0D > -impl Deref for ARef {=0D > +impl Deref for ARef {=0D > type Target =3D T;=0D > =0D > fn deref(&self) -> &Self::Target {=0D > @@ -168,7 +181,7 @@ fn from(b: &T) -> Self {=0D > }=0D > }=0D > =0D > -impl Drop for ARef {=0D > +impl Drop for ARef {=0D > fn drop(&mut self) {=0D > // SAFETY: The type invariants guarantee that the `ARef` owns th= e reference we're about to=0D > // decrement.=0D > diff --git a/rust/kernel/task.rs b/rust/kernel/task.rs=0D > index 38273f4eedb5..6259430b0ca3 100644=0D > --- a/rust/kernel/task.rs=0D > +++ b/rust/kernel/task.rs=0D > @@ -10,7 +10,12 @@=0D > pid_namespace::PidNamespace,=0D > prelude::*,=0D > sync::aref::ARef,=0D > - types::{NotThreadSafe, Opaque},=0D > + types::{=0D > + AlwaysRefCounted,=0D > + NotThreadSafe,=0D > + Opaque,=0D > + RefCounted, //=0D > + },=0D > };=0D > use core::{=0D > ops::Deref,=0D > @@ -347,7 +352,7 @@ pub fn group_leader(&self) -> &Task {=0D > }=0D > =0D > // SAFETY: The type invariants guarantee that `Task` is always refcounte= d.=0D > -unsafe impl crate::sync::aref::AlwaysRefCounted for Task {=0D > +unsafe impl RefCounted for Task {=0D > #[inline]=0D > fn inc_ref(&self) {=0D > // SAFETY: The existence of a shared reference means that the re= fcount is nonzero.=0D > @@ -361,6 +366,10 @@ unsafe fn dec_ref(obj: ptr::NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Task`.=0D > +unsafe impl AlwaysRefCounted for Task {}=0D > +=0D > impl PartialEq for Task {=0D > #[inline]=0D > fn eq(&self, other: &Self) -> bool {=0D > diff --git a/rust/kernel/types.rs b/rust/kernel/types.rs=0D > index 4aec7b699269..9b96aa2ebdb7 100644=0D > --- a/rust/kernel/types.rs=0D > +++ b/rust/kernel/types.rs=0D > @@ -18,7 +18,8 @@=0D > },=0D > sync::aref::{=0D > ARef,=0D > - AlwaysRefCounted, //=0D > + AlwaysRefCounted,=0D > + RefCounted, //=0D > }, //=0D > };=0D > =0D > diff --git a/rust/kernel/usb.rs b/rust/kernel/usb.rs=0D > index 9c17a672cd27..90b13e65cc82 100644=0D > --- a/rust/kernel/usb.rs=0D > +++ b/rust/kernel/usb.rs=0D > @@ -18,7 +18,10 @@=0D > to_result, //=0D > },=0D > prelude::*,=0D > - sync::aref::AlwaysRefCounted,=0D > + sync::aref::{=0D > + AlwaysRefCounted,=0D > + RefCounted, //=0D > + },=0D > types::Opaque,=0D > ThisModule, //=0D > };=0D > @@ -381,7 +384,7 @@ fn as_ref(&self) -> &Device {=0D > }=0D > =0D > // SAFETY: Instances of `Interface` are always reference-counted.=0D > -unsafe impl AlwaysRefCounted for Interface {=0D > +unsafe impl RefCounted for Interface {=0D > fn inc_ref(&self) {=0D > // SAFETY: The invariants of `Interface` guarantee that `self.as= _raw()`=0D > // returns a valid `struct usb_interface` pointer, for which we = will=0D > @@ -395,6 +398,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Interface`.=0D > +unsafe impl AlwaysRefCounted for Interface {}=0D > +=0D > // SAFETY: A `Interface` is always reference-counted and can be released= from any thread.=0D > unsafe impl Send for Interface {}=0D > =0D > @@ -432,7 +439,7 @@ fn as_raw(&self) -> *mut bindings::usb_device {=0D > kernel::impl_device_context_into_aref!(Device);=0D > =0D > // SAFETY: Instances of `Device` are always reference-counted.=0D > -unsafe impl AlwaysRefCounted for Device {=0D > +unsafe impl RefCounted for Device {=0D > fn inc_ref(&self) {=0D > // SAFETY: The invariants of `Device` guarantee that `self.as_ra= w()`=0D > // returns a valid `struct usb_device` pointer, for which we wil= l=0D > @@ -446,6 +453,10 @@ unsafe fn dec_ref(obj: NonNull) {=0D > }=0D > }=0D > =0D > +// SAFETY: We do not implement `Ownable`, thus it is okay to obtain an `= ARef` from a=0D > +// `&Device`.=0D > +unsafe impl AlwaysRefCounted for Device {}=0D > +=0D > impl AsRef> for Device {=0D > fn as_ref(&self) -> &device::Device {=0D > // SAFETY: By the type invariant of `Self`, `self.as_raw()` is a= pointer to a valid=0D > =0D > -- =0D > 2.51.2=0D > =0D > =0D