@@ -64,6 +64,63 @@ but it is intended that coverage is expanded as time goes on. "Leaf" modules
64
64
(e.g. drivers) should not use the C bindings directly. Instead, subsystems
65
65
should provide as-safe-as-possible abstractions as needed.
66
66
67
+ .. code-block ::
68
+
69
+ rust/bindings/
70
+ (rust/helpers.c)
71
+
72
+ include/ -----+ <-+
73
+ | |
74
+ drivers/ rust/kernel/ +----------+ <-+ |
75
+ fs/ | bindgen | |
76
+ .../ +-------------------+ +----------+ --+ |
77
+ | Abstractions | | |
78
+ +---------+ | +------+ +------+ | +----------+ | |
79
+ | my_foo | -----> | | foo | | bar | | -------> | Bindings | <-+ |
80
+ | driver | Safe | | sub- | | sub- | | Unsafe | | |
81
+ +---------+ | |system| |system| | | bindings | <-----+
82
+ | | +------+ +------+ | | crate | |
83
+ | | kernel crate | +----------+ |
84
+ | +-------------------+ |
85
+ | |
86
+ +------------------# FORBIDDEN #--------------------------------+
87
+
88
+ The main idea is to encapsulate all direct interaction with the kernel's C APIs
89
+ into carefully reviewed and documented abstractions. Then users of these
90
+ abstractions cannot introduce undefined behavior (UB) as long as:
91
+
92
+ #. The abstractions are correct ("sound").
93
+ #. Any ``unsafe `` blocks respect the safety contract necessary to call the
94
+ operations inside the block. Similarly, any ``unsafe impl ``\ s respect the
95
+ safety contract necessary to implement the trait.
96
+
97
+ Bindings
98
+ ~~~~~~~~
99
+
100
+ By including a C header from ``include/ `` into
101
+ ``rust/bindings/bindings_helper.h ``, the ``bindgen `` tool will auto-generate the
102
+ bindings for the included subsystem. After building, see the ``*_generated.rs ``
103
+ output files in the ``rust/bindings/ `` directory.
104
+
105
+ For parts of the C header that ``bindgen `` does not auto generate, e.g. C
106
+ ``inline `` functions or non-trivial macros, it is acceptable to add a small
107
+ wrapper function to ``rust/helpers.c `` to make it available for the Rust side as
108
+ well.
109
+
110
+ Abstractions
111
+ ~~~~~~~~~~~~
112
+
113
+ Abstractions are the layer between the bindings and the in-kernel users. They
114
+ are located in ``rust/kernel/ `` and their role is to encapsulate the unsafe
115
+ access to the bindings into an as-safe-as-possible API that they expose to their
116
+ users. Users of the abstractions include things like drivers or file systems
117
+ written in Rust.
118
+
119
+ Besides the safety aspect, the abstractions are supposed to be "ergonomic", in
120
+ the sense that they turn the C interfaces into "idiomatic" Rust code. Basic
121
+ examples are to turn the C resource acquisition and release into Rust
122
+ constructors and destructors or C integer error codes into Rust's ``Result ``\ s.
123
+
67
124
68
125
Conditional compilation
69
126
-----------------------
0 commit comments