Re: [PATCH v7 2/4] rust: kernel: Add pointer wrapper types for safe pointer formatting

[Alice Ryhl <aliceryhl@google.com>]

On Mon, Dec 29, 2025 at 03:21:20PM +0800, Ke Sun wrote:
> Add three pointer wrapper types (HashedPtr, RestrictedPtr, RawPtr) to
> rust/kernel/ptr.rs that correspond to C kernel's printk format specifiers
> %p, %pK, and %px. These types provide type-safe pointer formatting that
> matches C kernel patterns.
> 
> These wrapper types implement core::fmt::Pointer and delegate to the
> corresponding kernel formatting functions, enabling safe pointer
> formatting in Rust code that prevents information leaks about kernel
> memory layout.
> 
> Users can explicitly use these types:
>     pr_info!("{:p}\n", HashedPtr::from(ptr));
>     pr_info!("{:p}\n", RestrictedPtr::from(ptr));
>     pr_info!("{:p}\n", RawPtr::from(ptr));

These ::from calls are inconvenient. Why not just make the field public
and let users write:

	pr_info!("{:p}\n", HashedPtr(ptr));
	pr_info!("{:p}\n", RestrictedPtr(ptr));
	pr_info!("{:p}\n", RawPtr(ptr));

If the only concern is casts, then just make the struct generic:

	pub struct HashedPtr<T>(pub *const T);

Since *mut T will automatically downgrade to *const T, this should allow
HashedPtr(ptr) to work with any raw pointer.

> -use crate::build_assert;
> +use crate::{
> +    bindings,
> +    build_assert,
> +    ffi::c_void, //
> +};

Please use prelude::* instead of ffi::c_void.

>  /// Type representing an alignment, which is always a power of two.
>  ///
> @@ -225,3 +236,240 @@ fn align_up(self, alignment: Alignment) -> Option<Self> {
>  }
>  
>  impl_alignable_uint!(u8, u16, u32, u64, usize);
> +
> +/// Placeholder string used when pointer hashing is not ready yet.
> +const PTR_PLACEHOLDER: &str = if core::mem::size_of::<*const c_void>() == 8 {

size_of is in the kernel prelude.

> +impl fmt::Pointer for RestrictedPtr {
> +    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
> +        // Handle NULL pointers
> +        if self.0.is_null() {
> +            return Pointer::fmt(&self.0, f);
> +        }
> +
> +        // Use kptr_restrict_value to handle all kptr_restrict cases.
> +        // - Returns 0: kptr_restrict == 0, use original pointer (needs hashing)
> +        // - Returns 1: kptr_restrict == 1, *pptr may be modified to NULL if no permission
> +        // - Returns 2: kptr_restrict >= 2, *pptr is set to NULL
> +        // - Returns -1: IRQ context with kptr_restrict == 1 (error case)
> +        let mut ptr_value = self.0;
> +        // SAFETY: kptr_restrict_value handles capability checks and IRQ context.
> +        // It may modify ptr_value to NULL if there's no permission.
> +        let ret = unsafe { bindings::kptr_restrict_value(core::ptr::addr_of_mut!(ptr_value)) };

Simplifies to:

	let ret = unsafe { bindings::kptr_restrict_value(&raw mut ptr_value) };

or even:

	let ret = unsafe { bindings::kptr_restrict_value(&mut ptr_value) };

> +        match ret {
> +            -1 => {
> +                // IRQ context with kptr_restrict == 1 - print error placeholder
> +                // This should not happen in normal Rust code, but handle it gracefully
> +                f.pad("(pK-error)")

Why can't this happen in Rust code? Rust can run in IRQ context.

> +            }
> +            0 => {
> +                // kptr_restrict == 0: hash the pointer (same as %p)
> +                format_hashed_ptr(self.0, f)
> +            }
> +            1 => {
> +                // kptr_restrict == 1: print raw pointer if ptr_value is non-null,
> +                // otherwise print 0 (no permission)
> +                if ptr_value.is_null() {
> +                    Pointer::fmt(&core::ptr::null::<c_void>(), f)
> +                } else {
> +                    // Print the raw pointer directly (like %px)
> +                    // This matches C behavior: pointer_string() prints the raw address
> +                    Pointer::fmt(&ptr_value, f)
> +                }
> +            }
> +            _ => {
> +                // kptr_restrict >= 2: always print 0
> +                // ptr_value should already be NULL, but check to be safe
> +                Pointer::fmt(&core::ptr::null::<c_void>(), f)
> +            }
> +        }
> +    }
> +}

Alice