@@ -64,6 +64,63 @@ but it is intended that coverage is expanded as time goes on. "Leaf" modules
6464(e.g. drivers) should not use the C bindings directly. Instead, subsystems
6565should provide as-safe-as-possible abstractions as needed.
6666
67+ .. code-block ::
68+
69+ rust/bindings/
70+ (rust/helpers.c)
71+
72+ include/ -----+ <-+
73+ | |
74+ drivers/ rust/kernel/ +----------+ <-+ |
75+ fs/ | bindgen | |
76+ .../ +-------------------+ +----------+ --+ |
77+ | Abstractions | | |
78+ +---------+ | +------+ +------+ | +----------+ | |
79+ | my_foo | -----> | | foo | | bar | | -------> | Bindings | <-+ |
80+ | driver | Safe | | sub- | | sub- | | Unsafe | | |
81+ +---------+ | |system| |system| | | bindings | <-----+
82+ | | +------+ +------+ | | crate | |
83+ | | kernel crate | +----------+ |
84+ | +-------------------+ |
85+ | |
86+ +------------------# FORBIDDEN #--------------------------------+
87+
88+ The main idea is to encapsulate all direct interaction with the kernel's C APIs
89+ into carefully reviewed and documented abstractions. Then users of these
90+ abstractions cannot introduce undefined behavior (UB) as long as:
91+
92+ #. The abstractions are correct ("sound").
93+ #. Any ``unsafe `` blocks respect the safety contract necessary to call the
94+ operations inside the block. Similarly, any ``unsafe impl ``\ s respect the
95+ safety contract necessary to implement the trait.
96+
97+ Bindings
98+ ~~~~~~~~
99+
100+ By including a C header from ``include/ `` into
101+ ``rust/bindings/bindings_helper.h ``, the ``bindgen `` tool will auto-generate the
102+ bindings for the included subsystem. After building, see the ``*_generated.rs ``
103+ output files in the ``rust/bindings/ `` directory.
104+
105+ For parts of the C header that ``bindgen `` does not auto generate, e.g. C
106+ ``inline `` functions or non-trivial macros, it is acceptable to add a small
107+ wrapper function to ``rust/helpers.c `` to make it available for the Rust side as
108+ well.
109+
110+ Abstractions
111+ ~~~~~~~~~~~~
112+
113+ Abstractions are the layer between the bindings and the in-kernel users. They
114+ are located in ``rust/kernel/ `` and their role is to encapsulate the unsafe
115+ access to the bindings into an as-safe-as-possible API that they expose to their
116+ users. Users of the abstractions include things like drivers or file systems
117+ written in Rust.
118+
119+ Besides the safety aspect, the abstractions are supposed to be "ergonomic", in
120+ the sense that they turn the C interfaces into "idiomatic" Rust code. Basic
121+ examples are to turn the C resource acquisition and release into Rust
122+ constructors and destructors or C integer error codes into Rust's ``Result ``\ s.
123+
67124
68125Conditional compilation
69126-----------------------
0 commit comments