Paolo Bonzini <pbonz...@redhat.com> writes: > Provide an implementation of std::error::Error that bridges the Rust > anyhow::Error and std::panic::Location types with QEMU's Error*. > It also has several utility methods, analogous to error_propagate(), > that convert a Result into a return value + Error** pair. > > Signed-off-by: Paolo Bonzini <pbonz...@redhat.com>
My Rust-fu is far to weak for an actual review. But let me try to stumble through your patch. I'll pretend to explain the Rust code to a noob like myself. Please correct my mistakes. > --- > rust/Cargo.lock | 17 +++ > rust/Cargo.toml | 1 + > rust/meson.build | 2 + > rust/qemu-api/Cargo.toml | 2 + > rust/qemu-api/meson.build | 3 +- > rust/qemu-api/src/error.rs | 273 +++++++++++++++++++++++++++++++++++++ > rust/qemu-api/src/lib.rs | 3 + > 7 files changed, 300 insertions(+), 1 deletion(-) > create mode 100644 rust/qemu-api/src/error.rs > > diff --git a/rust/Cargo.lock b/rust/Cargo.lock > index 13d580c693b..37fd10064f9 100644 > --- a/rust/Cargo.lock > +++ b/rust/Cargo.lock > @@ -2,6 +2,12 @@ > # It is not intended for manual editing. > version = 3 > > +[[package]] > +name = "anyhow" > +version = "1.0.98" > +source = "registry+https://github.com/rust-lang/crates.io-index"; > +checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487" > + > [[package]] > name = "arbitrary-int" > version = "1.2.7" > @@ -37,6 +43,15 @@ version = "1.12.0" > source = "registry+https://github.com/rust-lang/crates.io-index"; > checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b" > > +[[package]] > +name = "foreign" > +version = "0.2.0" > +source = "registry+https://github.com/rust-lang/crates.io-index"; > +checksum = "37dd09e47ea8fd592a333f59fc52b894a97fe966ae9c6b7ef21ae38de6043462" > +dependencies = [ > + "libc", > +] > + > [[package]] > name = "hpet" > version = "0.1.0" > @@ -106,6 +121,8 @@ dependencies = [ > name = "qemu_api" > version = "0.1.0" > dependencies = [ > + "anyhow", > + "foreign", > "libc", > "qemu_api_macros", > ] > diff --git a/rust/Cargo.toml b/rust/Cargo.toml > index d9faeecb10b..2726b1f72e3 100644 > --- a/rust/Cargo.toml > +++ b/rust/Cargo.toml > @@ -67,6 +67,7 @@ multiple_crate_versions = "deny" > mut_mut = "deny" > needless_bitwise_bool = "deny" > needless_pass_by_ref_mut = "deny" > +needless_update = "deny" > no_effect_underscore_binding = "deny" > option_option = "deny" > or_fun_call = "deny" > diff --git a/rust/meson.build b/rust/meson.build > index 3e0b6ed4afa..9eb69174dea 100644 > --- a/rust/meson.build > +++ b/rust/meson.build > @@ -1,11 +1,13 @@ > subproject('anyhow-1.0-rs', required: true) > subproject('bilge-0.2-rs', required: true) > subproject('bilge-impl-0.2-rs', required: true) > +subproject('foreign-0.2-rs', required: true) > subproject('libc-0.2-rs', required: true) > > anyhow_rs = dependency('anyhow-1.0-rs') > bilge_rs = dependency('bilge-0.2-rs') > bilge_impl_rs = dependency('bilge-impl-0.2-rs') > +foreign_rs = dependency('foreign-0.2-rs') > libc_rs = dependency('libc-0.2-rs') > > subproject('proc-macro2-1-rs', required: true) > diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml > index c96cf50e7a1..ca6b81db10a 100644 > --- a/rust/qemu-api/Cargo.toml > +++ b/rust/qemu-api/Cargo.toml > @@ -15,7 +15,9 @@ rust-version.workspace = true > > [dependencies] > qemu_api_macros = { path = "../qemu-api-macros" } > +anyhow = "~1.0" > libc = "0.2.162" > +foreign = "~0.2" > > [features] > default = ["debug_cell"] > diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build > index 1ea86b8bbf1..11cbd6d375a 100644 > --- a/rust/qemu-api/meson.build > +++ b/rust/qemu-api/meson.build > @@ -19,6 +19,7 @@ _qemu_api_rs = static_library( > 'src/cell.rs', > 'src/chardev.rs', > 'src/errno.rs', > + 'src/error.rs', > 'src/irq.rs', > 'src/memory.rs', > 'src/module.rs', > @@ -35,7 +36,7 @@ _qemu_api_rs = static_library( > override_options: ['rust_std=2021', 'build.rust_std=2021'], > rust_abi: 'rust', > rust_args: _qemu_api_cfg, > - dependencies: [libc_rs, qemu_api_macros], > + dependencies: [anyhow_rs, foreign_rs, libc_rs, qemu_api_macros], > ) > > rust.test('rust-qemu-api-tests', _qemu_api_rs, Mere plumbing so far. I assume I don't need to understand it at this point :) > diff --git a/rust/qemu-api/src/error.rs b/rust/qemu-api/src/error.rs > new file mode 100644 > index 00000000000..f08fed81028 > --- /dev/null > +++ b/rust/qemu-api/src/error.rs > @@ -0,0 +1,273 @@ > +// SPDX-License-Identifier: GPL-2.0-or-later > + > +//! Error class for QEMU Rust code > +//! > +//! @author Paolo Bonzini > + > +use std::{ > + borrow::Cow, > + ffi::{c_char, c_int, c_void, CStr}, > + fmt::{self, Display}, > + panic, ptr, > +}; > + > +use foreign::{prelude::*, OwnedPointer}; > + > +use crate::{ > + bindings, > + bindings::{error_free, error_get_pretty}, > +}; > + > +pub type Result<T> = std::result::Result<T, Error>; > + > +#[derive(Debug, Default)] > +pub struct Error { We're defining a custom error type Error for use with Result<>. This requires implementing a number of traits. For trait Debug, we take the auto-generated solution here. Other traits are implemented below, in particular Display. I don't yet understand the role of trait Default. Does the name Error risk confusion with std::error::Error? > + msg: Option<Cow<'static, str>>, > + /// Appends the print string of the error to the msg if not None > + cause: Option<anyhow::Error>, > + file: &'static str, > + line: u32, > +} This is the Rust equivalent to C struct Error. High-level differences: * No @err_class. It's almost always ERROR_CLASS_GENERIC_ERROR in C nowadays. You're hardcoding that value in Rust for now. Good. * @cause, optional. This is the bridge to idiomatic Rust error types. * @msg is optional. This is so you can wrap a @cause without having to add some useless message. Is having Errors with neither @msg nor @cause a good idea? > + > +impl std::error::Error for Error { > + fn source(&self) -> Option<&(dyn std::error::Error + 'static)> { Provide the optional method source() that returns the lower-level source of the error, if any. I guess the system will put it to good use :) > + self.cause.as_ref().map(AsRef::as_ref) It returns the std::error::Error that's wrapped in @cause, if any. Reasonable. > + } > + > + #[allow(deprecated)] Needed for what? Oh, method description() is deprecated since 1.42.0: "use the Display impl or to_string()". I figure we need it because the new way doesn't work with our oldest supported Rust version. Could perhaps use a comment to help future garbage collectors. > + fn description(&self) -> &str { > + self.msg > + .as_deref() > + .or_else(|| > self.cause.as_deref().map(std::error::Error::description)) > + .unwrap_or("error") This gives us @msg, or else @cause, or else "error". Is it a good idea to ignore @cause when we have @msg? Above, I doubted the wisdom of having Errors with neither @msg nor @cause. description() returns the rather unhelpful "error" then. > + } > +} > + > +impl Display for Error { > + fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { > + let mut prefix = ""; > + if let Some(ref msg) = self.msg { > + write!(f, "{msg}")?; > + prefix = ": "; > + } > + if let Some(ref cause) = self.cause { > + write!(f, "{prefix}{cause}")?; > + } else if prefix.is_empty() { > + f.write_str("unknown error")?; > + } > + Ok(()) > + } This combines @msg and @cause: * If we have both: msg:cause * If we have just msg: msg * If we have just cause: cause * If we have neither: "unknown error" Differs from description(). Why? > +} > + > +impl From<String> for Error { > + #[track_caller] This enables use of panic::Location::caller().file() and .line() right below. Neat! > + fn from(msg: String) -> Self { > + let location = panic::Location::caller(); > + Error { > + msg: Some(Cow::Owned(msg)), > + file: location.file(), > + line: location.line(), > + ..Default::default() I don't understand this line, I'm afraid. > + } > + } This creates an Error from an error message string, recording the spot where it's done. The resulting Error has @msg, but not @cause. > +} > + > +impl From<&'static str> for Error { > + #[track_caller] > + fn from(msg: &'static str) -> Self { > + let location = panic::Location::caller(); > + Error { > + msg: Some(Cow::Borrowed(msg)), > + file: location.file(), > + line: location.line(), > + ..Default::default() > + } > + } > +} Same for another string type. > + > +impl From<anyhow::Error> for Error { > + #[track_caller] > + fn from(error: anyhow::Error) -> Self { > + let location = panic::Location::caller(); > + Error { > + cause: Some(error), > + file: location.file(), > + line: location.line(), > + ..Default::default() > + } > + } > +} This creates an Error from an anyhow::Error, recording the spot where it's done. The resulting Error has @cause, but not @msg. > + > +impl Error { > + /// Create a new error, prepending `msg` to the > + /// description of `cause` > + #[track_caller] > + pub fn with_error<E: std::error::Error + Send + Sync + 'static>(msg: > &'static str, cause: E) -> Self { > + let location = panic::Location::caller(); > + Error { > + msg: Some(Cow::Borrowed(msg)), > + cause: Some(cause.into()), > + file: location.file(), > + line: location.line(), > + } > + } This creates an Error from an error message string and an anyhow::Error, recording the spot where it's done. The resulting Error has both @msg and @cause. Is there a way to create an Error with neither @msg nor @cause? > + > + /// Consume a result, returning false if it is an error and > + /// true if it is successful. The error is propagated into > + /// `errp` like the C API `error_propagate` would do. > + /// > + /// # Safety > + /// > + /// `errp` must be valid; typically it is received from C code > + pub unsafe fn bool_or_propagate(result: Result<()>, errp: *mut *mut > bindings::Error) -> bool { > + // SAFETY: caller guarantees errp is valid > + unsafe { Self::ok_or_propagate(result, errp) }.is_some() > + } Note: I jumped down to ok_or_propagate(), then returned here. Note: I'm ignoring everything about safety in this first pass. Alright, this is "return true on success (nothing propagated), return false and propagate on error". Okay. > + > + /// Consume a result, returning a `NULL` pointer if it is an > + /// error and a C representation of the contents if it is > + /// successful. The error is propagated into `errp` like > + /// the C API `error_propagate` would do. > + /// > + /// # Safety > + /// > + /// `errp` must be valid; typically it is received from C code > + #[must_use] > + pub unsafe fn ptr_or_propagate<T: CloneToForeign>( > + result: Result<T>, > + errp: *mut *mut bindings::Error, > + ) -> *mut T::Foreign { > + // SAFETY: caller guarantees errp is valid > + unsafe { Self::ok_or_propagate(result, errp) }.clone_to_foreign_ptr() > + } And this is "return result as foreign pointer on success (nothing propagated), return NULL and propagate on error". Okay. > + > + /// Consume a result in the same way as `self.ok()`, but also propagate > + /// a possible error into `errp`, like the C API `error_propagate` > + /// would do. > + /// > + /// # Safety > + /// > + /// `errp` must be valid; typically it is received from C code > + pub unsafe fn ok_or_propagate<T>( > + result: Result<T>, @result is either a success value of type T, or an error value. > + errp: *mut *mut bindings::Error, > + ) -> Option<T> { > + let Err(err) = result else { If @result is an Error, put the error value in @err. > + return result.ok(); Else succeed and return the success value. > + }; > + > + // SAFETY: caller guarantees errp is valid > + unsafe { > + err.propagate(errp); > + } > + None @result is an Error. Propagate it, and return None. This is indeed like self.ok() with propagation added. > + } > + > + /// Equivalent of the C function `error_propagate`. Fill `*errp` > + /// with the information container in `result` if `errp` is not NULL; > + /// then consume it. Note error_propagate() has the arguments in the opposite order. > + /// > + /// # Safety > + /// > + /// `errp` must be valid; typically it is received from C code What does "valid" mean exactly? C error_propagate()'s function comment: /* * Propagate error object (if any) from @local_err to @dst_errp. * If @local_err is NULL, do nothing (because there's nothing to * propagate). * Else, if @dst_errp is NULL, errors are being ignored. Free the * error object. * Else, if @dst_errp is &error_abort, print a suitable message and * abort(). * Else, if @dst_errp is &error_fatal, print a suitable message and * exit(1). * Else, if @dst_errp already contains an error, ignore this one: free * the error object. * Else, move the error object from @local_err to *@dst_errp. * On return, @local_err is invalid. * Please use ERRP_GUARD() instead when possible. * Please don't error_propagate(&error_fatal, ...), use * error_report_err() and exit(), because that's more obvious. */ > + pub unsafe fn propagate(self, errp: *mut *mut bindings::Error) { The function comment mentions `result`. The function signature doesn't have it. Do you mean self? If yes, what does it mean to consume self? Ignored for now: how exactly the code below consumes. > + if errp.is_null() { Errors are being ignored. > + return; > + } > + > + let err = self.clone_to_foreign_ptr(); > + > + // SAFETY: caller guarantees errp is valid > + unsafe { > + errp.write(err); I *guess* this writes the foreign pointer we just obtained to @errp. > + } > + } Brief switch to the design level... In C, you're almost always better off with ERRP_GUARD(). Would you like me to elaborate? You still have to use error_propagate() to accumulate multiple errors so that the first one wins. That's commonly a dumb idea. Should we avoid this pattern in Rust? > + > + /// Convert a C `Error*` into a Rust `Result`, using > + /// `Ok(())` if `c_error` is NULL. > + /// > + /// # Safety > + /// > + /// `c_error` must be valid; typically it has been filled by a C > + /// function. What does "valid" mean exactly? > + pub unsafe fn err_or_unit(c_error: *mut bindings::Error) -> Result<()> { > + // SAFETY: caller guarantees c_error is valid > + unsafe { Self::err_or_else(c_error, || ()) } > + } > + > + /// Convert a C `Error*` into a Rust `Result`, calling `f()` to > + /// obtain an `Ok` value if `c_error` is NULL. > + /// > + /// # Safety > + /// > + /// `c_error` must be valid; typically it has been filled by a C > + /// function. > + pub unsafe fn err_or_else<T, F: FnOnce() -> T>( > + c_error: *mut bindings::Error, > + f: F, > + ) -> Result<T> { > + // SAFETY: caller guarantees c_error is valid > + let err = unsafe { Option::<Self>::from_foreign(c_error) }; > + match err { > + None => Ok(f()), > + Some(err) => Err(err), > + } > + } > +} Getting tired... > + > +impl FreeForeign for Error { > + type Foreign = bindings::Error; > + > + unsafe fn free_foreign(p: *mut bindings::Error) { > + // SAFETY: caller guarantees p is valid > + unsafe { > + error_free(p); > + } > + } > +} > + > +impl CloneToForeign for Error { > + fn clone_to_foreign(&self) -> OwnedPointer<Self> { > + // SAFETY: all arguments are controlled by this function > + unsafe { > + let err: *mut c_void = > libc::malloc(std::mem::size_of::<bindings::Error>()); > + let err: &mut bindings::Error = &mut *err.cast(); > + *err = bindings::Error { > + msg: format!("{self}").clone_to_foreign_ptr(), > + err_class: bindings::ERROR_CLASS_GENERIC_ERROR, > + src_len: self.file.len() as isize, > + src: self.file.as_ptr().cast::<c_char>(), > + line: self.line as c_int, > + func: ptr::null_mut(), > + hint: ptr::null_mut(), > + }; > + OwnedPointer::new(err) > + } > + } > +} Plausible to this Rust ignoramus :) > + > +impl FromForeign for Error { > + unsafe fn cloned_from_foreign(c_error: *const bindings::Error) -> Self { > + // SAFETY: caller guarantees c_error is valid > + unsafe { > + let error = &*c_error; > + let file = if error.src_len < 0 { > + // NUL-terminated > + CStr::from_ptr(error.src).to_str() > + } else { > + // Can become str::from_utf8 with Rust 1.87.0 > + std::str::from_utf8(std::slice::from_raw_parts( > + &*error.src.cast::<u8>(), > + error.src_len as usize, > + )) > + }; > + > + Error { > + msg: > FromForeign::cloned_from_foreign(error_get_pretty(error)), > + cause: None, > + file: file.unwrap(), > + line: error.line as u32, > + } > + } > + } > +} Likewise. > diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs > index 234a94e3c29..93902fc94bc 100644 > --- a/rust/qemu-api/src/lib.rs > +++ b/rust/qemu-api/src/lib.rs > @@ -19,6 +19,7 @@ > pub mod cell; > pub mod chardev; > pub mod errno; > +pub mod error; > pub mod irq; > pub mod memory; > pub mod module; > @@ -34,6 +35,8 @@ > ffi::c_void, > }; > > +pub use error::{Error, Result}; > + > #[cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)] > extern "C" { > fn g_aligned_alloc0(
