To support this, we need to move the `transmute` module into a separate
crate to allow the `bindings` crate to depend on it. Most user code is
still expected to address the module as `kernel::transmute`, which is a
re-export. `ffi::transmute` is now available for use in `bindings`.

Signed-off-by: Matthew Maurer <mmaurer@google.com>
---
 rust/Makefile                     | 14 +++++++++-----
 rust/bindgen_parameters           |  8 ++++++++
 rust/bindings/lib.rs              |  4 ++++
 rust/{ffi.rs => ffi/lib.rs}       |  5 +++++
 rust/{kernel => ffi}/transmute.rs |  0
 rust/kernel/lib.rs                |  2 +-
 rust/macros/lib.rs                | 24 ++++++++++++++++++++++--
 rust/macros/transmute.rs          | 12 +++++++-----
 rust/uapi/lib.rs                  |  4 ++++
 scripts/generate_rust_analyzer.py |  2 +-
 10 files changed, 61 insertions(+), 14 deletions(-)

diff --git a/rust/Makefile b/rust/Makefile
index 5d357dce1704d15e43effc528be8f5a4d74d3d8d..178aa3036c4acba1c4c266196912da2d60fe0d5f 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -207,7 +207,7 @@ rustdoc-compiler_builtins: $(src)/compiler_builtins.rs rustdoc-core FORCE
 	+$(call if_changed,rustdoc)
 
 rustdoc-ffi: private is-kernel-object := y
-rustdoc-ffi: $(src)/ffi.rs rustdoc-core FORCE
+rustdoc-ffi: $(src)/ffi/lib.rs rustdoc-core FORCE
 	+$(call if_changed,rustdoc)
 
 rustdoc-pin_init_internal: private rustdoc_host = yes
@@ -249,7 +249,7 @@ quiet_cmd_rustc_test_library = $(RUSTC_OR_CLIPPY_QUIET) TL $<
 rusttestlib-build_error: $(src)/build_error.rs FORCE
 	+$(call if_changed,rustc_test_library)
 
-rusttestlib-ffi: $(src)/ffi.rs FORCE
+rusttestlib-ffi: $(src)/ffi/lib.rs FORCE
 	+$(call if_changed,rustc_test_library)
 
 rusttestlib-proc_macro2: private rustc_target_flags = $(proc_macro2-flags)
@@ -657,22 +657,26 @@ $(obj)/build_error.o: $(src)/build_error.rs $(obj)/compiler_builtins.o FORCE
 	+$(call if_changed_rule,rustc_library)
 
 $(obj)/ffi.o: private skip_gendwarfksyms = 1
-$(obj)/ffi.o: $(src)/ffi.rs $(obj)/compiler_builtins.o FORCE
+$(obj)/ffi.o: $(src)/ffi/lib.rs $(obj)/compiler_builtins.o FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init \
+	--extern macros
 $(obj)/bindings.o: $(src)/bindings/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/$(libmacros_name) \
     $(obj)/bindings/bindings_generated.rs \
     $(obj)/bindings/bindings_helpers_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
-$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
+$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
+	--extern macros
 $(obj)/uapi.o: private skip_gendwarfksyms = 1
 $(obj)/uapi.o: $(src)/uapi/lib.rs \
     $(obj)/ffi.o \
     $(obj)/pin_init.o \
+    $(obj)/$(libmacros_name) \
     $(obj)/uapi/uapi_generated.rs FORCE
 	+$(call if_changed_rule,rustc_library)
 
diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
index fd2fd1c3cb9a51ea46fcd721907783b457aa1378..d56343ca03979e345f8adb7eb8fd7f2b9d4be6ee 100644
--- a/rust/bindgen_parameters
+++ b/rust/bindgen_parameters
@@ -64,3 +64,11 @@
 # Structs should implement `Zeroable` when all of their fields do.
 --with-derive-custom-struct .*=MaybeZeroable
 --with-derive-custom-union .*=MaybeZeroable
+
+# Every C struct can try to derive FromBytes. If they have unmet requirements,
+# the impl will just be a no-op due to the where clause.
+--with-derive-custom-struct .*=FromBytesFfi
+
+# We can't auto-derive AsBytes, as we need a const-time check to see if there
+# is padding involved. Add it explicitly when you expect no padding.
+--with-derive-custom-struct cpumask=AsBytesFfi
diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
index 0c57cf9b4004f176997c59ecc58a9a9ac76163d9..c29312fca1b01b707bb11b05d446d44480a4b81f 100644
--- a/rust/bindings/lib.rs
+++ b/rust/bindings/lib.rs
@@ -31,6 +31,10 @@
 #[allow(clippy::undocumented_unsafe_blocks)]
 #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
 mod bindings_raw {
+    use macros::{
+        AsBytesFfi,
+        FromBytesFfi, //
+    };
     use pin_init::{MaybeZeroable, Zeroable};
 
     // Manual definition for blocklisted types.
diff --git a/rust/ffi.rs b/rust/ffi/lib.rs
similarity index 87%
rename from rust/ffi.rs
rename to rust/ffi/lib.rs
index f961e9728f590fd2c52d4c03a1f715d654051d04..14052362f091a609bc505fe6eca77fe998fe2321 100644
--- a/rust/ffi.rs
+++ b/rust/ffi/lib.rs
@@ -10,6 +10,11 @@
 
 #![no_std]
 
+#[doc(hidden)]
+// This lives here to make it accessible to `bindings`, similar to the other `ffi` types.
+// User code should access it through `kernel::transmute`.
+pub mod transmute;
+
 macro_rules! alias {
     ($($name:ident = $ty:ty;)*) => {$(
         #[allow(non_camel_case_types, missing_docs)]
diff --git a/rust/kernel/transmute.rs b/rust/ffi/transmute.rs
similarity index 100%
rename from rust/kernel/transmute.rs
rename to rust/ffi/transmute.rs
diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
index f812cf12004286962985a068665443dc22c389a2..4aa54dd83319ef16bd4baa1964114f1e6549942b 100644
--- a/rust/kernel/lib.rs
+++ b/rust/kernel/lib.rs
@@ -63,6 +63,7 @@
 extern crate self as kernel;
 
 pub use ffi;
+pub use ffi::transmute;
 
 pub mod acpi;
 pub mod alloc;
@@ -146,7 +147,6 @@
 pub mod task;
 pub mod time;
 pub mod tracepoint;
-pub mod transmute;
 pub mod types;
 pub mod uaccess;
 #[cfg(CONFIG_USB = "y")]
diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
index d66397942529f67697f74a908e257cacc4201d84..bde94c2a8ddf708872bcd56a4713784b5ccdf04e 100644
--- a/rust/macros/lib.rs
+++ b/rust/macros/lib.rs
@@ -506,7 +506,7 @@ pub fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
 #[proc_macro_derive(FromBytes)]
 pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
     let input = parse_macro_input!(tokens as DeriveInput);
-    transmute::from_bytes(input).into()
+    transmute::from_bytes("kernel", input).into()
 }
 
 /// Implements `AsBytes` for a struct.
@@ -536,5 +536,25 @@ pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
 #[proc_macro_derive(AsBytes)]
 pub fn derive_as_bytes(tokens: TokenStream) -> TokenStream {
     let input = parse_macro_input!(tokens as DeriveInput);
-    transmute::as_bytes(input).into()
+    transmute::as_bytes("kernel", input).into()
+}
+
+#[doc(hidden)]
+#[proc_macro_derive(FromBytesFfi)]
+/// This is equivalent to `FromBytes`, but uses the `ffi` crate as the trait definition site
+/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
+/// trait through `kernel`.
+pub fn derive_from_bytes_trait(tokens: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(tokens as DeriveInput);
+    transmute::from_bytes("ffi", input).into()
+}
+
+#[doc(hidden)]
+#[proc_macro_derive(AsBytesFfi)]
+/// This is equivalent to `AsBytes`, but uses the `ffi` crate as the trait definition site
+/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
+/// trait through `kernel`.
+pub fn derive_as_bytes_trait(tokens: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(tokens as DeriveInput);
+    transmute::as_bytes("ffi", input).into()
 }
diff --git a/rust/macros/transmute.rs b/rust/macros/transmute.rs
index 43cf36a1334f1fed23c0e777026392f987f78d8d..9bd6d279675fb1d58cdceff1f4dde0dcf33fbf99 100644
--- a/rust/macros/transmute.rs
+++ b/rust/macros/transmute.rs
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 
-use proc_macro2::TokenStream;
+use proc_macro2::{Span, TokenStream};
 use syn::{parse_quote, DeriveInput, Fields, Ident, ItemConst, Path, WhereClause};
 
 fn all_fields_impl(fields: &Fields, trait_: &Path) -> WhereClause {
@@ -19,7 +19,8 @@ fn struct_padding_check(fields: &Fields, name: &Ident) -> ItemConst {
     }
 }
 
-pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
+pub(crate) fn as_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
+    let crate_ = Ident::new(crate_, Span::call_site());
     if !input.generics.params.is_empty() {
         return quote::quote! { compile_error!("#[derive(AsBytes)] does not support generics") };
     }
@@ -27,7 +28,7 @@ pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
         return quote::quote! { compile_error!("#[derive(AsBytes)] only supports structs") };
     };
     let name = input.ident;
-    let trait_ = parse_quote! { ::kernel::transmute::AsBytes };
+    let trait_ = parse_quote! { ::#crate_::transmute::AsBytes };
     let where_clause = all_fields_impl(&ds.fields, &trait_);
     let padding_check = struct_padding_check(&ds.fields, &name);
     quote::quote! {
@@ -37,13 +38,14 @@ unsafe impl #trait_ for #name #where_clause {}
     }
 }
 
-pub(crate) fn from_bytes(input: DeriveInput) -> TokenStream {
+pub(crate) fn from_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
+    let crate_ = Ident::new(crate_, Span::call_site());
     let syn::Data::Struct(ref ds) = &input.data else {
         return quote::quote! { compile_error!("#[derive(FromBytes)] only supports structs") };
     };
     let (impl_generics, ty_generics, base_where_clause) = input.generics.split_for_impl();
     let name = input.ident;
-    let trait_ = parse_quote! { ::kernel::transmute::FromBytes };
+    let trait_ = parse_quote! { ::#crate_::transmute::FromBytes };
     let mut where_clause = all_fields_impl(&ds.fields, &trait_);
     if let Some(base_clause) = base_where_clause {
         where_clause
diff --git a/rust/uapi/lib.rs b/rust/uapi/lib.rs
index 1d5fd9efb93e9db97fec84fca2bae37b500c20c5..2033b7125558d7ccfae67b94777f5ce59593a528 100644
--- a/rust/uapi/lib.rs
+++ b/rust/uapi/lib.rs
@@ -34,6 +34,10 @@
 type __kernel_ssize_t = isize;
 type __kernel_ptrdiff_t = isize;
 
+use macros::{
+    AsBytesFfi,
+    FromBytesFfi, //
+};
 use pin_init::MaybeZeroable;
 
 include!(concat!(env!("OBJTREE"), "/rust/uapi/uapi_generated.rs"));
diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
index 147d0cc940681426771db865bc2462e7029a6d7d..843d081eacaca8edeeac5978bd8107a498008186 100755
--- a/scripts/generate_rust_analyzer.py
+++ b/scripts/generate_rust_analyzer.py
@@ -137,7 +137,7 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs, core_edit
 
     append_crate(
         "ffi",
-        srctree / "rust" / "ffi.rs",
+        srctree / "rust" / "ffi" / "lib.rs",
         ["core", "compiler_builtins"],
     )
 

-- 
2.52.0.305.g3fc767764a-goog

Matthew,

> On 15 Dec 2025, at 21:44, Matthew Maurer <mmaurer@google.com> wrote:
> 
> To support this, we need to move the `transmute` module into a separate
> crate to allow the `bindings` crate to depend on it. Most user code is
> still expected to address the module as `kernel::transmute`, which is a
> re-export. `ffi::transmute` is now available for use in `bindings`.

Thanks, that’s really useful for Tyr.

> 
> Signed-off-by: Matthew Maurer <mmaurer@google.com>
> ---
> rust/Makefile                     | 14 +++++++++-----
> rust/bindgen_parameters           |  8 ++++++++
> rust/bindings/lib.rs              |  4 ++++
> rust/{ffi.rs => ffi/lib.rs}       |  5 +++++
> rust/{kernel => ffi}/transmute.rs |  0
> rust/kernel/lib.rs                |  2 +-
> rust/macros/lib.rs                | 24 ++++++++++++++++++++++--
> rust/macros/transmute.rs          | 12 +++++++-----
> rust/uapi/lib.rs                  |  4 ++++
> scripts/generate_rust_analyzer.py |  2 +-
> 10 files changed, 61 insertions(+), 14 deletions(-)
> 
> diff --git a/rust/Makefile b/rust/Makefile
> index 5d357dce1704d15e43effc528be8f5a4d74d3d8d..178aa3036c4acba1c4c266196912da2d60fe0d5f 100644
> --- a/rust/Makefile
> +++ b/rust/Makefile
> @@ -207,7 +207,7 @@ rustdoc-compiler_builtins: $(src)/compiler_builtins.rs rustdoc-core FORCE
> +$(call if_changed,rustdoc)
> 
> rustdoc-ffi: private is-kernel-object := y
> -rustdoc-ffi: $(src)/ffi.rs rustdoc-core FORCE
> +rustdoc-ffi: $(src)/ffi/lib.rs rustdoc-core FORCE
> +$(call if_changed,rustdoc)
> 
> rustdoc-pin_init_internal: private rustdoc_host = yes
> @@ -249,7 +249,7 @@ quiet_cmd_rustc_test_library = $(RUSTC_OR_CLIPPY_QUIET) TL $<
> rusttestlib-build_error: $(src)/build_error.rs FORCE
> +$(call if_changed,rustc_test_library)
> 
> -rusttestlib-ffi: $(src)/ffi.rs FORCE
> +rusttestlib-ffi: $(src)/ffi/lib.rs FORCE
> +$(call if_changed,rustc_test_library)
> 
> rusttestlib-proc_macro2: private rustc_target_flags = $(proc_macro2-flags)
> @@ -657,22 +657,26 @@ $(obj)/build_error.o: $(src)/build_error.rs $(obj)/compiler_builtins.o FORCE
> +$(call if_changed_rule,rustc_library)
> 
> $(obj)/ffi.o: private skip_gendwarfksyms = 1
> -$(obj)/ffi.o: $(src)/ffi.rs $(obj)/compiler_builtins.o FORCE
> +$(obj)/ffi.o: $(src)/ffi/lib.rs $(obj)/compiler_builtins.o FORCE
> +$(call if_changed_rule,rustc_library)
> 
> -$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init
> +$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init \
> + --extern macros
> $(obj)/bindings.o: $(src)/bindings/lib.rs \
>     $(obj)/ffi.o \
>     $(obj)/pin_init.o \
> +    $(obj)/$(libmacros_name) \
>     $(obj)/bindings/bindings_generated.rs \
>     $(obj)/bindings/bindings_helpers_generated.rs FORCE
> +$(call if_changed_rule,rustc_library)
> 
> -$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
> +$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
> + --extern macros
> $(obj)/uapi.o: private skip_gendwarfksyms = 1
> $(obj)/uapi.o: $(src)/uapi/lib.rs \
>     $(obj)/ffi.o \
>     $(obj)/pin_init.o \
> +    $(obj)/$(libmacros_name) \
>     $(obj)/uapi/uapi_generated.rs FORCE
> +$(call if_changed_rule,rustc_library)

+1 on splitting the above into a separate commit

> 
> diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> index fd2fd1c3cb9a51ea46fcd721907783b457aa1378..d56343ca03979e345f8adb7eb8fd7f2b9d4be6ee 100644
> --- a/rust/bindgen_parameters
> +++ b/rust/bindgen_parameters
> @@ -64,3 +64,11 @@
> # Structs should implement `Zeroable` when all of their fields do.
> --with-derive-custom-struct .*=MaybeZeroable
> --with-derive-custom-union .*=MaybeZeroable
> +
> +# Every C struct can try to derive FromBytes. If they have unmet requirements,
> +# the impl will just be a no-op due to the where clause.
> +--with-derive-custom-struct .*=FromBytesFfi
> +
> +# We can't auto-derive AsBytes, as we need a const-time check to see if there
> +# is padding involved. Add it explicitly when you expect no padding.
> +--with-derive-custom-struct cpumask=AsBytesFfi
> diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
> index 0c57cf9b4004f176997c59ecc58a9a9ac76163d9..c29312fca1b01b707bb11b05d446d44480a4b81f 100644
> --- a/rust/bindings/lib.rs
> +++ b/rust/bindings/lib.rs
> @@ -31,6 +31,10 @@
> #[allow(clippy::undocumented_unsafe_blocks)]
> #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
> mod bindings_raw {
> +    use macros::{
> +        AsBytesFfi,
> +        FromBytesFfi, //
> +    };
>     use pin_init::{MaybeZeroable, Zeroable};
> 
>     // Manual definition for blocklisted types.
> diff --git a/rust/ffi.rs b/rust/ffi/lib.rs
> similarity index 87%
> rename from rust/ffi.rs
> rename to rust/ffi/lib.rs
> index f961e9728f590fd2c52d4c03a1f715d654051d04..14052362f091a609bc505fe6eca77fe998fe2321 100644
> --- a/rust/ffi.rs
> +++ b/rust/ffi/lib.rs
> @@ -10,6 +10,11 @@
> 
> #![no_std]
> 
> +#[doc(hidden)]
> +// This lives here to make it accessible to `bindings`, similar to the other `ffi` types.
> +// User code should access it through `kernel::transmute`.
> +pub mod transmute;
> +
> macro_rules! alias {
>     ($($name:ident = $ty:ty;)*) => {$(
>         #[allow(non_camel_case_types, missing_docs)]
> diff --git a/rust/kernel/transmute.rs b/rust/ffi/transmute.rs
> similarity index 100%
> rename from rust/kernel/transmute.rs
> rename to rust/ffi/transmute.rs
> diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
> index f812cf12004286962985a068665443dc22c389a2..4aa54dd83319ef16bd4baa1964114f1e6549942b 100644
> --- a/rust/kernel/lib.rs
> +++ b/rust/kernel/lib.rs
> @@ -63,6 +63,7 @@
> extern crate self as kernel;
> 
> pub use ffi;
> +pub use ffi::transmute;
> 
> pub mod acpi;
> pub mod alloc;
> @@ -146,7 +147,6 @@
> pub mod task;
> pub mod time;
> pub mod tracepoint;
> -pub mod transmute;
> pub mod types;
> pub mod uaccess;
> #[cfg(CONFIG_USB = "y")]
> diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
> index d66397942529f67697f74a908e257cacc4201d84..bde94c2a8ddf708872bcd56a4713784b5ccdf04e 100644
> --- a/rust/macros/lib.rs
> +++ b/rust/macros/lib.rs
> @@ -506,7 +506,7 @@ pub fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
> #[proc_macro_derive(FromBytes)]
> pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
>     let input = parse_macro_input!(tokens as DeriveInput);
> -    transmute::from_bytes(input).into()
> +    transmute::from_bytes("kernel", input).into()
> }
> 
> /// Implements `AsBytes` for a struct.
> @@ -536,5 +536,25 @@ pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
> #[proc_macro_derive(AsBytes)]
> pub fn derive_as_bytes(tokens: TokenStream) -> TokenStream {
>     let input = parse_macro_input!(tokens as DeriveInput);
> -    transmute::as_bytes(input).into()
> +    transmute::as_bytes("kernel", input).into()
> +}
> +
> +#[doc(hidden)]
> +#[proc_macro_derive(FromBytesFfi)]

Let’s perhaps capitalize this as FromBytesFFI?

> +/// This is equivalent to `FromBytes`, but uses the `ffi` crate as the trait definition site
> +/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
> +/// trait through `kernel`.
> +pub fn derive_from_bytes_trait(tokens: TokenStream) -> TokenStream {
> +    let input = parse_macro_input!(tokens as DeriveInput);
> +    transmute::from_bytes("ffi", input).into()
> +}
> +
> +#[doc(hidden)]
> +#[proc_macro_derive(AsBytesFfi)]

Same here?

> +/// This is equivalent to `AsBytes`, but uses the `ffi` crate as the trait definition site
> +/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
> +/// trait through `kernel`.
> +pub fn derive_as_bytes_trait(tokens: TokenStream) -> TokenStream {
> +    let input = parse_macro_input!(tokens as DeriveInput);
> +    transmute::as_bytes("ffi", input).into()
> }
> diff --git a/rust/macros/transmute.rs b/rust/macros/transmute.rs
> index 43cf36a1334f1fed23c0e777026392f987f78d8d..9bd6d279675fb1d58cdceff1f4dde0dcf33fbf99 100644
> --- a/rust/macros/transmute.rs
> +++ b/rust/macros/transmute.rs
> @@ -1,6 +1,6 @@
> // SPDX-License-Identifier: GPL-2.0
> 
> -use proc_macro2::TokenStream;
> +use proc_macro2::{Span, TokenStream};
> use syn::{parse_quote, DeriveInput, Fields, Ident, ItemConst, Path, WhereClause};
> 
> fn all_fields_impl(fields: &Fields, trait_: &Path) -> WhereClause {
> @@ -19,7 +19,8 @@ fn struct_padding_check(fields: &Fields, name: &Ident) -> ItemConst {
>     }
> }
> 
> -pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
> +pub(crate) fn as_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
> +    let crate_ = Ident::new(crate_, Span::call_site());
>     if !input.generics.params.is_empty() {
>         return quote::quote! { compile_error!("#[derive(AsBytes)] does not support generics") };
>     }
> @@ -27,7 +28,7 @@ pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
>         return quote::quote! { compile_error!("#[derive(AsBytes)] only supports structs") };
>     };
>     let name = input.ident;
> -    let trait_ = parse_quote! { ::kernel::transmute::AsBytes };
> +    let trait_ = parse_quote! { ::#crate_::transmute::AsBytes };
>     let where_clause = all_fields_impl(&ds.fields, &trait_);
>     let padding_check = struct_padding_check(&ds.fields, &name);
>     quote::quote! {
> @@ -37,13 +38,14 @@ unsafe impl #trait_ for #name #where_clause {}
>     }
> }
> 
> -pub(crate) fn from_bytes(input: DeriveInput) -> TokenStream {
> +pub(crate) fn from_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
> +    let crate_ = Ident::new(crate_, Span::call_site());
>     let syn::Data::Struct(ref ds) = &input.data else {
>         return quote::quote! { compile_error!("#[derive(FromBytes)] only supports structs") };
>     };
>     let (impl_generics, ty_generics, base_where_clause) = input.generics.split_for_impl();
>     let name = input.ident;
> -    let trait_ = parse_quote! { ::kernel::transmute::FromBytes };
> +    let trait_ = parse_quote! { ::#crate_::transmute::FromBytes };
>     let mut where_clause = all_fields_impl(&ds.fields, &trait_);
>     if let Some(base_clause) = base_where_clause {
>         where_clause
> diff --git a/rust/uapi/lib.rs b/rust/uapi/lib.rs
> index 1d5fd9efb93e9db97fec84fca2bae37b500c20c5..2033b7125558d7ccfae67b94777f5ce59593a528 100644
> --- a/rust/uapi/lib.rs
> +++ b/rust/uapi/lib.rs
> @@ -34,6 +34,10 @@
> type __kernel_ssize_t = isize;
> type __kernel_ptrdiff_t = isize;
> 
> +use macros::{
> +    AsBytesFfi,
> +    FromBytesFfi, //

Why is this “//" here? Is this related to the import style change that took place recently?

> +};
> use pin_init::MaybeZeroable;
> 
> include!(concat!(env!("OBJTREE"), "/rust/uapi/uapi_generated.rs"));
> diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
> index 147d0cc940681426771db865bc2462e7029a6d7d..843d081eacaca8edeeac5978bd8107a498008186 100755
> --- a/scripts/generate_rust_analyzer.py
> +++ b/scripts/generate_rust_analyzer.py
> @@ -137,7 +137,7 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs, core_edit
> 
>     append_crate(
>         "ffi",
> -        srctree / "rust" / "ffi.rs",
> +        srctree / "rust" / "ffi" / "lib.rs",
>         ["core", "compiler_builtins"],
>     )
> 
> 
> -- 
> 2.52.0.305.g3fc767764a-goog
> 
> 

^ IMHO, this should also be in separate commit.

Looks good to me overall.

— Daniel

On Wed, Dec 17, 2025 at 11:26 AM Daniel Almeida
<daniel.almeida@collabora.com> wrote:
>
> Matthew,
>
> > On 15 Dec 2025, at 21:44, Matthew Maurer <mmaurer@google.com> wrote:
> >
> > To support this, we need to move the `transmute` module into a separate
> > crate to allow the `bindings` crate to depend on it. Most user code is
> > still expected to address the module as `kernel::transmute`, which is a
> > re-export. `ffi::transmute` is now available for use in `bindings`.
>
> Thanks, that’s really useful for Tyr.
>
> >
> > Signed-off-by: Matthew Maurer <mmaurer@google.com>
> > ---
> > rust/Makefile                     | 14 +++++++++-----
> > rust/bindgen_parameters           |  8 ++++++++
> > rust/bindings/lib.rs              |  4 ++++
> > rust/{ffi.rs => ffi/lib.rs}       |  5 +++++
> > rust/{kernel => ffi}/transmute.rs |  0
> > rust/kernel/lib.rs                |  2 +-
> > rust/macros/lib.rs                | 24 ++++++++++++++++++++++--
> > rust/macros/transmute.rs          | 12 +++++++-----
> > rust/uapi/lib.rs                  |  4 ++++
> > scripts/generate_rust_analyzer.py |  2 +-
> > 10 files changed, 61 insertions(+), 14 deletions(-)
> >
> > diff --git a/rust/Makefile b/rust/Makefile
> > index 5d357dce1704d15e43effc528be8f5a4d74d3d8d..178aa3036c4acba1c4c266196912da2d60fe0d5f 100644
> > --- a/rust/Makefile
> > +++ b/rust/Makefile
> > @@ -207,7 +207,7 @@ rustdoc-compiler_builtins: $(src)/compiler_builtins.rs rustdoc-core FORCE
> > +$(call if_changed,rustdoc)
> >
> > rustdoc-ffi: private is-kernel-object := y
> > -rustdoc-ffi: $(src)/ffi.rs rustdoc-core FORCE
> > +rustdoc-ffi: $(src)/ffi/lib.rs rustdoc-core FORCE
> > +$(call if_changed,rustdoc)
> >
> > rustdoc-pin_init_internal: private rustdoc_host = yes
> > @@ -249,7 +249,7 @@ quiet_cmd_rustc_test_library = $(RUSTC_OR_CLIPPY_QUIET) TL $<
> > rusttestlib-build_error: $(src)/build_error.rs FORCE
> > +$(call if_changed,rustc_test_library)
> >
> > -rusttestlib-ffi: $(src)/ffi.rs FORCE
> > +rusttestlib-ffi: $(src)/ffi/lib.rs FORCE
> > +$(call if_changed,rustc_test_library)
> >
> > rusttestlib-proc_macro2: private rustc_target_flags = $(proc_macro2-flags)
> > @@ -657,22 +657,26 @@ $(obj)/build_error.o: $(src)/build_error.rs $(obj)/compiler_builtins.o FORCE
> > +$(call if_changed_rule,rustc_library)
> >
> > $(obj)/ffi.o: private skip_gendwarfksyms = 1
> > -$(obj)/ffi.o: $(src)/ffi.rs $(obj)/compiler_builtins.o FORCE
> > +$(obj)/ffi.o: $(src)/ffi/lib.rs $(obj)/compiler_builtins.o FORCE
> > +$(call if_changed_rule,rustc_library)
> >
> > -$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init
> > +$(obj)/bindings.o: private rustc_target_flags = --extern ffi --extern pin_init \
> > + --extern macros
> > $(obj)/bindings.o: $(src)/bindings/lib.rs \
> >     $(obj)/ffi.o \
> >     $(obj)/pin_init.o \
> > +    $(obj)/$(libmacros_name) \
> >     $(obj)/bindings/bindings_generated.rs \
> >     $(obj)/bindings/bindings_helpers_generated.rs FORCE
> > +$(call if_changed_rule,rustc_library)
> >
> > -$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init
> > +$(obj)/uapi.o: private rustc_target_flags = --extern ffi --extern pin_init \
> > + --extern macros
> > $(obj)/uapi.o: private skip_gendwarfksyms = 1
> > $(obj)/uapi.o: $(src)/uapi/lib.rs \
> >     $(obj)/ffi.o \
> >     $(obj)/pin_init.o \
> > +    $(obj)/$(libmacros_name) \
> >     $(obj)/uapi/uapi_generated.rs FORCE
> > +$(call if_changed_rule,rustc_library)
>
> +1 on splitting the above into a separate commit

Sure, I'll do that in the next rev. Two people seems like enough of a signal :)

>
> >
> > diff --git a/rust/bindgen_parameters b/rust/bindgen_parameters
> > index fd2fd1c3cb9a51ea46fcd721907783b457aa1378..d56343ca03979e345f8adb7eb8fd7f2b9d4be6ee 100644
> > --- a/rust/bindgen_parameters
> > +++ b/rust/bindgen_parameters
> > @@ -64,3 +64,11 @@
> > # Structs should implement `Zeroable` when all of their fields do.
> > --with-derive-custom-struct .*=MaybeZeroable
> > --with-derive-custom-union .*=MaybeZeroable
> > +
> > +# Every C struct can try to derive FromBytes. If they have unmet requirements,
> > +# the impl will just be a no-op due to the where clause.
> > +--with-derive-custom-struct .*=FromBytesFfi
> > +
> > +# We can't auto-derive AsBytes, as we need a const-time check to see if there
> > +# is padding involved. Add it explicitly when you expect no padding.
> > +--with-derive-custom-struct cpumask=AsBytesFfi
> > diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
> > index 0c57cf9b4004f176997c59ecc58a9a9ac76163d9..c29312fca1b01b707bb11b05d446d44480a4b81f 100644
> > --- a/rust/bindings/lib.rs
> > +++ b/rust/bindings/lib.rs
> > @@ -31,6 +31,10 @@
> > #[allow(clippy::undocumented_unsafe_blocks)]
> > #[cfg_attr(CONFIG_RUSTC_HAS_UNNECESSARY_TRANSMUTES, allow(unnecessary_transmutes))]
> > mod bindings_raw {
> > +    use macros::{
> > +        AsBytesFfi,
> > +        FromBytesFfi, //
> > +    };
> >     use pin_init::{MaybeZeroable, Zeroable};
> >
> >     // Manual definition for blocklisted types.
> > diff --git a/rust/ffi.rs b/rust/ffi/lib.rs
> > similarity index 87%
> > rename from rust/ffi.rs
> > rename to rust/ffi/lib.rs
> > index f961e9728f590fd2c52d4c03a1f715d654051d04..14052362f091a609bc505fe6eca77fe998fe2321 100644
> > --- a/rust/ffi.rs
> > +++ b/rust/ffi/lib.rs
> > @@ -10,6 +10,11 @@
> >
> > #![no_std]
> >
> > +#[doc(hidden)]
> > +// This lives here to make it accessible to `bindings`, similar to the other `ffi` types.
> > +// User code should access it through `kernel::transmute`.
> > +pub mod transmute;
> > +
> > macro_rules! alias {
> >     ($($name:ident = $ty:ty;)*) => {$(
> >         #[allow(non_camel_case_types, missing_docs)]
> > diff --git a/rust/kernel/transmute.rs b/rust/ffi/transmute.rs
> > similarity index 100%
> > rename from rust/kernel/transmute.rs
> > rename to rust/ffi/transmute.rs
> > diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
> > index f812cf12004286962985a068665443dc22c389a2..4aa54dd83319ef16bd4baa1964114f1e6549942b 100644
> > --- a/rust/kernel/lib.rs
> > +++ b/rust/kernel/lib.rs
> > @@ -63,6 +63,7 @@
> > extern crate self as kernel;
> >
> > pub use ffi;
> > +pub use ffi::transmute;
> >
> > pub mod acpi;
> > pub mod alloc;
> > @@ -146,7 +147,6 @@
> > pub mod task;
> > pub mod time;
> > pub mod tracepoint;
> > -pub mod transmute;
> > pub mod types;
> > pub mod uaccess;
> > #[cfg(CONFIG_USB = "y")]
> > diff --git a/rust/macros/lib.rs b/rust/macros/lib.rs
> > index d66397942529f67697f74a908e257cacc4201d84..bde94c2a8ddf708872bcd56a4713784b5ccdf04e 100644
> > --- a/rust/macros/lib.rs
> > +++ b/rust/macros/lib.rs
> > @@ -506,7 +506,7 @@ pub fn kunit_tests(attr: TokenStream, ts: TokenStream) -> TokenStream {
> > #[proc_macro_derive(FromBytes)]
> > pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
> >     let input = parse_macro_input!(tokens as DeriveInput);
> > -    transmute::from_bytes(input).into()
> > +    transmute::from_bytes("kernel", input).into()
> > }
> >
> > /// Implements `AsBytes` for a struct.
> > @@ -536,5 +536,25 @@ pub fn derive_from_bytes(tokens: TokenStream) -> TokenStream {
> > #[proc_macro_derive(AsBytes)]
> > pub fn derive_as_bytes(tokens: TokenStream) -> TokenStream {
> >     let input = parse_macro_input!(tokens as DeriveInput);
> > -    transmute::as_bytes(input).into()
> > +    transmute::as_bytes("kernel", input).into()
> > +}
> > +
> > +#[doc(hidden)]
> > +#[proc_macro_derive(FromBytesFfi)]
>
> Let’s perhaps capitalize this as FromBytesFFI?

Our Rust coding guidelines[1] do not specify a kernel-specific
practice here, and say to defer to standard ecosystem guidance[2].
Derive macros take the position of traits, which should be in
UpperCamelCase. There is an explicit section which reads: "In
UpperCamelCase, acronyms and contractions of compound words count as
one word: use Uuid rather than UUID". While we are free to define our
own naming standards in the kernel, I do not see anything in the
current Rust coding guidelines[2] to overrule standard guidance here.

[1]: https://docs.kernel.org/rust/coding-guidelines.html
[2]: https://rust-lang.github.io/api-guidelines/naming.html

>
> > +/// This is equivalent to `FromBytes`, but uses the `ffi` crate as the trait definition site
> > +/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
> > +/// trait through `kernel`.
> > +pub fn derive_from_bytes_trait(tokens: TokenStream) -> TokenStream {
> > +    let input = parse_macro_input!(tokens as DeriveInput);
> > +    transmute::from_bytes("ffi", input).into()
> > +}
> > +
> > +#[doc(hidden)]
> > +#[proc_macro_derive(AsBytesFfi)]
>
> Same here?
>
> > +/// This is equivalent to `AsBytes`, but uses the `ffi` crate as the trait definition site
> > +/// instead of `kernel`. This is intended for use inside `bindings`. Everyone else can refer to the
> > +/// trait through `kernel`.
> > +pub fn derive_as_bytes_trait(tokens: TokenStream) -> TokenStream {
> > +    let input = parse_macro_input!(tokens as DeriveInput);
> > +    transmute::as_bytes("ffi", input).into()
> > }
> > diff --git a/rust/macros/transmute.rs b/rust/macros/transmute.rs
> > index 43cf36a1334f1fed23c0e777026392f987f78d8d..9bd6d279675fb1d58cdceff1f4dde0dcf33fbf99 100644
> > --- a/rust/macros/transmute.rs
> > +++ b/rust/macros/transmute.rs
> > @@ -1,6 +1,6 @@
> > // SPDX-License-Identifier: GPL-2.0
> >
> > -use proc_macro2::TokenStream;
> > +use proc_macro2::{Span, TokenStream};
> > use syn::{parse_quote, DeriveInput, Fields, Ident, ItemConst, Path, WhereClause};
> >
> > fn all_fields_impl(fields: &Fields, trait_: &Path) -> WhereClause {
> > @@ -19,7 +19,8 @@ fn struct_padding_check(fields: &Fields, name: &Ident) -> ItemConst {
> >     }
> > }
> >
> > -pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
> > +pub(crate) fn as_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
> > +    let crate_ = Ident::new(crate_, Span::call_site());
> >     if !input.generics.params.is_empty() {
> >         return quote::quote! { compile_error!("#[derive(AsBytes)] does not support generics") };
> >     }
> > @@ -27,7 +28,7 @@ pub(crate) fn as_bytes(input: DeriveInput) -> TokenStream {
> >         return quote::quote! { compile_error!("#[derive(AsBytes)] only supports structs") };
> >     };
> >     let name = input.ident;
> > -    let trait_ = parse_quote! { ::kernel::transmute::AsBytes };
> > +    let trait_ = parse_quote! { ::#crate_::transmute::AsBytes };
> >     let where_clause = all_fields_impl(&ds.fields, &trait_);
> >     let padding_check = struct_padding_check(&ds.fields, &name);
> >     quote::quote! {
> > @@ -37,13 +38,14 @@ unsafe impl #trait_ for #name #where_clause {}
> >     }
> > }
> >
> > -pub(crate) fn from_bytes(input: DeriveInput) -> TokenStream {
> > +pub(crate) fn from_bytes(crate_: &str, input: DeriveInput) -> TokenStream {
> > +    let crate_ = Ident::new(crate_, Span::call_site());
> >     let syn::Data::Struct(ref ds) = &input.data else {
> >         return quote::quote! { compile_error!("#[derive(FromBytes)] only supports structs") };
> >     };
> >     let (impl_generics, ty_generics, base_where_clause) = input.generics.split_for_impl();
> >     let name = input.ident;
> > -    let trait_ = parse_quote! { ::kernel::transmute::FromBytes };
> > +    let trait_ = parse_quote! { ::#crate_::transmute::FromBytes };
> >     let mut where_clause = all_fields_impl(&ds.fields, &trait_);
> >     if let Some(base_clause) = base_where_clause {
> >         where_clause
> > diff --git a/rust/uapi/lib.rs b/rust/uapi/lib.rs
> > index 1d5fd9efb93e9db97fec84fca2bae37b500c20c5..2033b7125558d7ccfae67b94777f5ce59593a528 100644
> > --- a/rust/uapi/lib.rs
> > +++ b/rust/uapi/lib.rs
> > @@ -34,6 +34,10 @@
> > type __kernel_ssize_t = isize;
> > type __kernel_ptrdiff_t = isize;
> >
> > +use macros::{
> > +    AsBytesFfi,
> > +    FromBytesFfi, //
>
> Why is this “//" here? Is this related to the import style change that took place recently?
>
> > +};
> > use pin_init::MaybeZeroable;
> >
> > include!(concat!(env!("OBJTREE"), "/rust/uapi/uapi_generated.rs"));
> > diff --git a/scripts/generate_rust_analyzer.py b/scripts/generate_rust_analyzer.py
> > index 147d0cc940681426771db865bc2462e7029a6d7d..843d081eacaca8edeeac5978bd8107a498008186 100755
> > --- a/scripts/generate_rust_analyzer.py
> > +++ b/scripts/generate_rust_analyzer.py
> > @@ -137,7 +137,7 @@ def generate_crates(srctree, objtree, sysroot_src, external_src, cfgs, core_edit
> >
> >     append_crate(
> >         "ffi",
> > -        srctree / "rust" / "ffi.rs",
> > +        srctree / "rust" / "ffi" / "lib.rs",
> >         ["core", "compiler_builtins"],
> >     )
> >
> >
> > --
> > 2.52.0.305.g3fc767764a-goog
> >
> >
>
> ^ IMHO, this should also be in separate commit.
>
> Looks good to me overall.
>
> — Daniel
>

On Tue Dec 16, 2025 at 9:44 AM JST, Matthew Maurer wrote:
> To support this, we need to move the `transmute` module into a separate
> crate to allow the `bindings` crate to depend on it. Most user code is
> still expected to address the module as `kernel::transmute`, which is a
> re-export. `ffi::transmute` is now available for use in `bindings`.
>
> Signed-off-by: Matthew Maurer <mmaurer@google.com>

Maybe this should be two commits, one for the new crate, another one to
introduce the ability to use on bindgen types.

I have tried this with the Nova bindings, and somehow could not get past
this error:

    error[E0433]: failed to resolve: could not find `ffi` in the list of imported crates
      --> ../drivers/gpu/nova-core/gsp/fw/r570_144/bindings.rs:321:54
        |
    321 | #[derive(Debug, Default, Copy, Clone, MaybeZeroable, FromBytesFfi)]
        |                                                      ^^^^^^^^^^^^ could not find `ffi` in the list of imported crates
        |
        = note: this error originates in the derive macro `FromBytesFfi` (in Nightly builds, run with -Z macro-backtrace for more info)

I do have `kernel::ffi` imported in the bindings module though, so I am
not quite sure what this is about. Any idea?

On Tue, Dec 16, 2025 at 7:16 PM Alexandre Courbot <acourbot@nvidia.com> wrote:
>
> On Tue Dec 16, 2025 at 9:44 AM JST, Matthew Maurer wrote:
> > To support this, we need to move the `transmute` module into a separate
> > crate to allow the `bindings` crate to depend on it. Most user code is
> > still expected to address the module as `kernel::transmute`, which is a
> > re-export. `ffi::transmute` is now available for use in `bindings`.
> >
> > Signed-off-by: Matthew Maurer <mmaurer@google.com>
>
> Maybe this should be two commits, one for the new crate, another one to
> introduce the ability to use on bindgen types.

I could do this if people think it'd be helpful, but moving it into
the `ffi` crate has no point without using on the main set of bindgen
types.

>
> I have tried this with the Nova bindings, and somehow could not get past
> this error:
>
>     error[E0433]: failed to resolve: could not find `ffi` in the list of imported crates
>       --> ../drivers/gpu/nova-core/gsp/fw/r570_144/bindings.rs:321:54
>         |
>     321 | #[derive(Debug, Default, Copy, Clone, MaybeZeroable, FromBytesFfi)]
>         |                                                      ^^^^^^^^^^^^ could not find `ffi` in the list of imported crates
>         |
>         = note: this error originates in the derive macro `FromBytesFfi` (in Nightly builds, run with -Z macro-backtrace for more info)
>
> I do have `kernel::ffi` imported in the bindings module though, so I am
> not quite sure what this is about. Any idea?

If you have the kernel module available, please set the bindgen flag
to apply `FromBytes` and `AsBytes` rather than `FromBytesFfi` and
`AsBytesFfi`. Those are only for the crates that are used by the
kernel crate, and so do not have access to the `kernel` crate.

The macro itself will generate `::kernel::transmute::FromBytes` when
you use `FromBytes` and `::ffi::transmute::FromBytes` when you use
`FromBytesFfi`, specifically to avoid weirdness around namespaces and
imports.

If for some reason you really wanted to use `FromBytesFfi` (you
shouldn't, but just so you understand the mechanism), you'd need to
add a direct dependency edge on the `ffi` crate, i.e. `--extern crate
ffi`