[PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[Alice Ryhl]

Currently, VTable::fw_rpc_callback() takes scope as a u32, whereas C
calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With kCFI enabled,
enum types are encoded distinctly from integers, causing every fw_rpc
indirect call into a Rust fwctl driver to trip a CFI failure. Thus,
generate fwctl_rpc_scope as a newtype with a cfi_encoding attribute and
use it in fw_rpc_callback().

Cc: stable@vger.kernel.org
Fixes: e052daab94ee ("rust: introduce abstractions for fwctl")
Signed-off-by: Alice Ryhl <aliceryhl@google.com>
---
 rust/bindgen_parameters |  2 ++
 rust/kernel/fwctl.rs    | 12 ++++++------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index 8402b0c93545..e4f8c07743a8 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -27,6 +27,8 @@
 --opaque-type spinlock
 
 # enums that appear in indirect function calls should specify a cfi type
+--newtype-enum fwctl_rpc_scope
+--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
 --newtype-enum lru_status
 --with-attribute-custom-enum=lru_status='#[cfi_encoding="10lru_status"]'
 
diff --git a/rust/kernel/fwctl.rs b/rust/kernel/fwctl.rs
index f29244fb0d1d..b7778e4d5ee0 100644
--- a/rust/kernel/fwctl.rs
+++ b/rust/kernel/fwctl.rs
@@ -53,13 +53,13 @@ pub enum DeviceType {
 #[derive(Copy, Clone, Debug, Eq, PartialEq)]
 pub enum RpcScope {
     /// Read/write access to device configuration.
-    Configuration = bindings::fwctl_rpc_scope_FWCTL_RPC_CONFIGURATION,
+    Configuration = bindings::fwctl_rpc_scope::FWCTL_RPC_CONFIGURATION.0,
     /// Read-only access to debug information.
-    DebugReadOnly = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_READ_ONLY,
+    DebugReadOnly = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_READ_ONLY.0,
     /// Write access to lockdown-compatible debug information.
-    DebugWrite = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE,
+    DebugWrite = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE.0,
     /// Full read/write access to all debug information (requires `CAP_SYS_RAWIO`).
-    DebugWriteFull = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE_FULL,
+    DebugWriteFull = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE_FULL.0,
 }
 
 impl TryFrom<u32> for RpcScope {
@@ -539,12 +539,12 @@ impl<T: Operations> VTable<T> {
     /// - `out_len` must be valid for reading and writing an initialised `usize`.
     unsafe extern "C" fn fw_rpc_callback(
         uctx: *mut bindings::fwctl_uctx,
-        scope: u32,
+        scope: bindings::fwctl_rpc_scope,
         rpc_in: *mut ffi::c_void,
         in_len: usize,
         out_len: *mut usize,
     ) -> *mut ffi::c_void {
-        let scope = match RpcScope::try_from(scope) {
+        let scope = match RpcScope::try_from(scope.0) {
             Ok(s) => s,
             Err(e) => return Error::to_ptr(e),
         };

---
base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
change-id: 20261020-fwctl-cfi-encoding-70766ce0a03a

Best regards,
-- 
Alice Ryhl <aliceryhl@google.com>

Re: [PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[Zhi Wang]

On Tue, 20 Oct 2026 08:28:37 +0000
Alice Ryhl <aliceryhl@google.com> wrote:

> Currently, VTable::fw_rpc_callback() takes scope as a u32, whereas C
> calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With kCFI enabled,
> enum types are encoded distinctly from integers, causing every fw_rpc
> indirect call into a Rust fwctl driver to trip a CFI failure. Thus,
> generate fwctl_rpc_scope as a newtype with a cfi_encoding attribute
> and use it in fw_rpc_callback().
> 

Thanks for the fix. Looks good to me. 

Reviewed-by: Zhi Wang <zhiw@nvidia.com>

BTW: I saw this “lru_status” needs the same treatment, guess bindgen
will someday automatically handle this?

Z.

> Cc: stable@vger.kernel.org
> Fixes: e052daab94ee ("rust: introduce abstractions for fwctl")
> Signed-off-by: Alice Ryhl <aliceryhl@google.com>
> ---
>  rust/bindgen_parameters |  2 ++
>  rust/kernel/fwctl.rs    | 12 ++++++------
>  2 files changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> index 8402b0c93545..e4f8c07743a8 100644
> --- a/rust/bindgen_parameters
> +++ b/rust/bindgen_parameters
> @@ -27,6 +27,8 @@
>  --opaque-type spinlock
>  
>  # enums that appear in indirect function calls should specify a cfi
> type +--newtype-enum fwctl_rpc_scope
> +--with-attribute-custom-enum=fwctl_rpc_scope='#[cfi_encoding="15fwctl_rpc_scope"]'
>  --newtype-enum lru_status
>  --with-attribute-custom-enum=lru_status='#[cfi_encoding="10lru_status"]'
>  
> diff --git a/rust/kernel/fwctl.rs b/rust/kernel/fwctl.rs
> index f29244fb0d1d..b7778e4d5ee0 100644
> --- a/rust/kernel/fwctl.rs
> +++ b/rust/kernel/fwctl.rs
> @@ -53,13 +53,13 @@ pub enum DeviceType {
>  #[derive(Copy, Clone, Debug, Eq, PartialEq)]
>  pub enum RpcScope {
>      /// Read/write access to device configuration.
> -    Configuration =
> bindings::fwctl_rpc_scope_FWCTL_RPC_CONFIGURATION,
> +    Configuration =
> bindings::fwctl_rpc_scope::FWCTL_RPC_CONFIGURATION.0, /// Read-only
> access to debug information.
> -    DebugReadOnly =
> bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_READ_ONLY,
> +    DebugReadOnly =
> bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_READ_ONLY.0, /// Write
> access to lockdown-compatible debug information.
> -    DebugWrite = bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE,
> +    DebugWrite = bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE.0,
>      /// Full read/write access to all debug information (requires
> `CAP_SYS_RAWIO`).
> -    DebugWriteFull =
> bindings::fwctl_rpc_scope_FWCTL_RPC_DEBUG_WRITE_FULL,
> +    DebugWriteFull =
> bindings::fwctl_rpc_scope::FWCTL_RPC_DEBUG_WRITE_FULL.0, }
>  
>  impl TryFrom<u32> for RpcScope {
> @@ -539,12 +539,12 @@ impl<T: Operations> VTable<T> {
>      /// - `out_len` must be valid for reading and writing an
> initialised `usize`. unsafe extern "C" fn fw_rpc_callback(
>          uctx: *mut bindings::fwctl_uctx,
> -        scope: u32,
> +        scope: bindings::fwctl_rpc_scope,
>          rpc_in: *mut ffi::c_void,
>          in_len: usize,
>          out_len: *mut usize,
>      ) -> *mut ffi::c_void {
> -        let scope = match RpcScope::try_from(scope) {
> +        let scope = match RpcScope::try_from(scope.0) {
>              Ok(s) => s,
>              Err(e) => return Error::to_ptr(e),
>          };
> 
> ---
> base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
> change-id: 20261020-fwctl-cfi-encoding-70766ce0a03a
> 
> Best regards,

Re: [PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[Alice Ryhl]

On Tue, Oct 20, 2026 at 10:56 AM Zhi Wang <zhiw@nvidia.com> wrote:
>
> On Tue, 20 Oct 2026 08:28:37 +0000
> Alice Ryhl <aliceryhl@google.com> wrote:
>
> > Currently, VTable::fw_rpc_callback() takes scope as a u32, whereas C
> > calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With kCFI enabled,
> > enum types are encoded distinctly from integers, causing every fw_rpc
> > indirect call into a Rust fwctl driver to trip a CFI failure. Thus,
> > generate fwctl_rpc_scope as a newtype with a cfi_encoding attribute
> > and use it in fw_rpc_callback().
> >
>
> Thanks for the fix. Looks good to me.
>
> Reviewed-by: Zhi Wang <zhiw@nvidia.com>
>
> BTW: I saw this “lru_status” needs the same treatment, guess bindgen
> will someday automatically handle this?

I believe lru_status is already handled.

Alice

Re: [PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[Zhi Wang]

On Tue, 20 Oct 2026 11:04:43 +0200
Alice Ryhl <aliceryhl@google.com> wrote:

> On Tue, Oct 20, 2026 at 10:56 AM Zhi Wang <zhiw@nvidia.com> wrote:
> >
> > On Tue, 20 Oct 2026 08:28:37 +0000
> > Alice Ryhl <aliceryhl@google.com> wrote:
> >  
> > > Currently, VTable::fw_rpc_callback() takes scope as a u32,
> > > whereas C calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With
> > > kCFI enabled, enum types are encoded distinctly from integers,
> > > causing every fw_rpc indirect call into a Rust fwctl driver to
> > > trip a CFI failure. Thus, generate fwctl_rpc_scope as a newtype
> > > with a cfi_encoding attribute and use it in fw_rpc_callback().
> > >  
> >
> > Thanks for the fix. Looks good to me.
> >
> > Reviewed-by: Zhi Wang <zhiw@nvidia.com>
> >
> > BTW: I saw this “lru_status” needs the same treatment, guess bindgen
> > will someday automatically handle this?  
> 
> I believe lru_status is already handled.
> 

Yes, lru_status is already handled.

I meant that both lru_status and fwctl_rpc_scope need explicit entries
in rust/bindgen_parameters. I was wondering whether there are plans for
bindgen to generate the newtype and matching CFI encoding automatically
for enums used in function-pointer signatures, so future additions
wouldn't need the same manual setup.

> Alice
> 

Re: [PATCH] rust: fwctl: declare cfi_encoding for fwctl_rpc_scope

[Alice Ryhl]

On Tue, Oct 20, 2026 at 11:09 AM Zhi Wang <zhiw@nvidia.com> wrote:
>
> On Tue, 20 Oct 2026 11:04:43 +0200
> Alice Ryhl <aliceryhl@google.com> wrote:
>
> > On Tue, Oct 20, 2026 at 10:56 AM Zhi Wang <zhiw@nvidia.com> wrote:
> > >
> > > On Tue, 20 Oct 2026 08:28:37 +0000
> > > Alice Ryhl <aliceryhl@google.com> wrote:
> > >
> > > > Currently, VTable::fw_rpc_callback() takes scope as a u32,
> > > > whereas C calls fwctl_ops::fw_rpc with enum fwctl_rpc_scope. With
> > > > kCFI enabled, enum types are encoded distinctly from integers,
> > > > causing every fw_rpc indirect call into a Rust fwctl driver to
> > > > trip a CFI failure. Thus, generate fwctl_rpc_scope as a newtype
> > > > with a cfi_encoding attribute and use it in fw_rpc_callback().
> > > >
> > >
> > > Thanks for the fix. Looks good to me.
> > >
> > > Reviewed-by: Zhi Wang <zhiw@nvidia.com>
> > >
> > > BTW: I saw this “lru_status” needs the same treatment, guess bindgen
> > > will someday automatically handle this?
> >
> > I believe lru_status is already handled.
> >
>
> Yes, lru_status is already handled.
>
> I meant that both lru_status and fwctl_rpc_scope need explicit entries
> in rust/bindgen_parameters. I was wondering whether there are plans for
> bindgen to generate the newtype and matching CFI encoding automatically
> for enums used in function-pointer signatures, so future additions
> wouldn't need the same manual setup.

That would be nice, but I'm not aware of anyone working on it.

Alice