Fix implicit_provenance_casts warnings on Xous by bjorn3 · Pull Request #159174 · rust-lang/rust

bjorn3 · 2026-07-12T09:53:28Z

rustbot · 2026-07-12T09:53:33Z

rustbot has assigned @clarfonthey.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @ChrisDenton, libs
@ChrisDenton, libs expanded to 13 candidates
Random selection from Darksonn, JohnTitor, Mark-Simulacrum, clarfonthey, jhpratt

bjorn3 · 2026-07-12T09:53:35Z

cc @xobs

xobs · 2026-07-12T09:56:02Z

Thank you for addressing these.

RalfJung · 2026-07-12T09:56:12Z

The point of these warnings is to actually audit whether exposing is necessary or whether strict provenance could be used instead. Did you actually check this or just replace is everywhere?

bjorn3 · 2026-07-12T10:08:04Z

For lend_mut_impl and lend_impl the kernel will read through the passed in pointer. It might be possible to directly pass the pointer to the as block instead. For map_memory the kernel will replace the memory allocation at the given address if there was one. And unmap_memory will deallocate the allocation. And finally create_thread will invoke the function pointer and use the passed in stack for the new thread.

In Thread::new, guard_page_pre and data are both read/deallocated by the thread_start. And tls_table_slow also need the pointer to be exposed for TLS accesses to be allowed.

xobs · 2026-07-12T10:10:26Z

The documentation isn't very clear. It seems that for strict provenance, you use .with_addr(), but to do that you already need to have a pointer.

The problem is that these addresses come from the kernel via a syscall, so they're just a bare usize when the functions return. What's the correct way to go from a syscall return value to a pointer without using .exposed_provenance()?

RalfJung · 2026-07-12T10:13:03Z

@xobs there is no exposed_provenance. There is expose_provenance which goes from a pointer to an integer, which is the opposite direction of what you are talking about. So I can't quite follow your question.

It seems that @bjorn3 is saying that the kernel APIs here are all designed such that they take integers when they actually should take pointers (i.e. this is about inputs to syscalls, not return values)? Yeah if APIs don't use pointer types properly then expose_provenance is what one has to do. Might be worth a few comments.

clarfonthey · 2026-07-12T12:32:14Z

There's with_exposed_provenance, but based upon what the docs say, it's not possible to start from exposed provenance, only return to it. But maybe this is the right choice for this kind of API.

I know that the provenance of external addresses is something that has been discussed a lot and not really resolved. From a libs perspective, the code looks okay (r=me), but I'm going to defer to opsem for review since it feels more important that this is semantically correct rather than just passing a lint.

r? RalfJung since you've already taken a look, but feel free to reroll if you'd rather not review.

rustbot · 2026-07-12T12:32:19Z

RalfJung is not on the review rotation at the moment.
They may take a while to respond.

RalfJung · 2026-07-12T12:41:01Z

There's with_exposed_provenance, but based upon what the docs say, it's not possible to start from exposed provenance, only return to it. But maybe this is the right choice for this kind of API.

As long as they have been exposed "on the other side" of the FFI (which we can generally assume for cases like this), that's fine.

But this PR doesn't even call with_exposed_provenance.

RalfJung · 2026-07-17T07:52:29Z

@rustbot author
for more comments

In favor of passing raw pointers to inline asm.

bjorn3 · 2026-07-20T14:18:22Z

I've removed all exposed_provenance calls in favor of passing raw pointers to the inline asm blocks. I think this is fine.

RalfJung · 2026-07-20T14:28:25Z

That makes a lot of sense to me conceptually, thanks!
However, I can't review changes of this sort...
@rustbot reroll
And @xobs if you could take another look at the latest version that'd be great.

Darksonn · 2026-07-25T14:57:16Z

    } else {
        Err(Error::InternalError)
    }
 }

 /// Creates a thread with a given stack and up to four arguments.
-pub(crate) fn create_thread(
-    start: *mut usize,
+pub(crate) unsafe fn create_thread<T>(


Will this generic lead to extra machine code due to monomorphisation?

View changes since the review

There is only a single monomorphic caller.

Darksonn

@bors r+

View changes since this review

rust-bors · 2026-07-25T15:31:47Z

📌 Commit 7b0af92 has been approved by Darksonn

It is now in the queue for this repository.

rust-bors · 2026-07-25T16:49:24Z

⌛ Testing commit 7b0af92 with merge d4fe0ef...

Workflow: https://github.com/rust-lang/rust/actions/runs/30166393781

Fix implicit_provenance_casts warnings on Xous

JonathanBrouwer · 2026-07-25T17:06:08Z

@bors yield

rust-bors · 2026-07-25T17:06:11Z

Auto build was cancelled. Cancelled workflows:

https://github.com/rust-lang/rust/actions/runs/30166393781

The next pull request likely to be tested is #159455.

Fix implicit_provenance_casts warnings on Xous

…uwer Rollup of 25 pull requests Successful merges: - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158404 (trait_solver: normalize next-gen region constraints) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159174 (Fix implicit_provenance_casts warnings on Xous) - #159179 (enable `unreachable_cfg_select_predicates` lint as part of `unused` lint group) - #159518 (iter: extend step_by specialization to cover StepBy<RangeIter<{integer}>>) - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159700 (Split non-local `semicolon_in_expressions_from_macros` into a separate lint) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159785 (Share _Unwind_Exception definition between native and wasm) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159695 (proc_macro: Fix cfg_attr inner attrs in file modules) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`)

Fix implicit_provenance_casts warnings on Xous

…uwer Rollup of 25 pull requests Successful merges: - #159825 (codegen: handle OperandValue::Uninit in codegen_return_terminator) - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158404 (trait_solver: normalize next-gen region constraints) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159174 (Fix implicit_provenance_casts warnings on Xous) - #159179 (enable `unreachable_cfg_select_predicates` lint as part of `unused` lint group) - #159518 (iter: extend step_by specialization to cover StepBy<RangeIter<{integer}>>) - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159700 (Split non-local `semicolon_in_expressions_from_macros` into a separate lint) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159695 (proc_macro: Fix cfg_attr inner attrs in file modules) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`)

Fix implicit_provenance_casts warnings on Xous

Rollup of 25 pull requests Successful merges: - #138618 (Support using const pointers in asm `const` operand) - #157962 (Lower paths to functions in const args as ConstKind::Error) - #158709 (rustdoc: warn on improperly interleaved HTML/MD) - #159174 (Fix implicit_provenance_casts warnings on Xous) - #159179 (enable `unreachable_cfg_select_predicates` lint as part of `unused` lint group) - #159518 (iter: extend step_by specialization to cover StepBy<RangeIter<{integer}>>) - #159673 (bootstrap: forward -fdebug-prefix-map when using cc) - #159700 (Split non-local `semicolon_in_expressions_from_macros` into a separate lint) - #159720 (document #[global_allocator] constraints) - #159732 (optimization: don't look for diagnostic/canonical items without rustc_attrs enabled) - #159738 (implement `CovariantUnsafeCell`) - #159740 (reuse regular exported_non_generic_symbols logic in Miri) - #159780 (check `extern "custom"` function pointers) - #159786 (rustdoc-js: ignore editor temp files in test folder discovery) - #159819 (std::sync::poison: disable auto_cfg on PoisonError::new) - #152439 (Fix typos and grammar in library documentation) - #155388 (stepping into where-clauses during normalization may be productive) - #155914 (when bailing on ambiguity, don't force other results to ambig) - #159204 (Add support to caller_location to rustc_public) - #159439 (Fix(lib/fs/win): Fall back on Win32 delete for `Dir::remove_file`) - #159676 (Update wasm-component-ld to 0.5.27) - #159695 (proc_macro: Fix cfg_attr inner attrs in file modules) - #159730 (allow accessing the contents of UnsafeCell without going through get) - #159809 (Avoid `#[target_features]`) - #159878 (bootstrap: Remove obsolete option `build.compiletest-use-stage0-libtest`)

Rollup merge of #159174 - bjorn3:fix_xous_warnings, r=Darksonn Fix implicit_provenance_casts warnings on Xous

Fix implicit_provenance_casts warnings on Xous

d062ad2

bjorn3 added the O-xous OS: A microkernel OS for privacy in computing label Jul 12, 2026

rustbot assigned clarfonthey Jul 12, 2026

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. T-libs Relevant to the library team, which will review and decide on the PR/issue. labels Jul 12, 2026

bjorn3 mentioned this pull request Jul 12, 2026

Simplify the unwind crate #159010

Merged

bjorn3 commented Jul 12, 2026

View reviewed changes

Comment thread library/std/src/os/xous/ffi.rs

rustbot assigned RalfJung and unassigned clarfonthey Jul 12, 2026

rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 17, 2026

Get rid of expose_provenance on Xous

d3e8e6b

In favor of passing raw pointers to inline asm.

bjorn3 added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Jul 20, 2026

bjorn3 force-pushed the fix_xous_warnings branch from 67d0825 to d3e8e6b Compare July 20, 2026 14:19

rustbot assigned Darksonn and unassigned RalfJung Jul 20, 2026

Darksonn reviewed Jul 25, 2026

View reviewed changes

Darksonn added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Jul 25, 2026

Darksonn approved these changes Jul 25, 2026

View reviewed changes

rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Jul 25, 2026

rust-bors Bot pushed a commit that referenced this pull request Jul 25, 2026

Auto merge of #159174 - bjorn3:fix_xous_warnings, r=Darksonn

d4fe0ef

Fix implicit_provenance_casts warnings on Xous

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 25, 2026

Rollup merge of rust-lang#159174 - bjorn3:fix_xous_warnings, r=Darksonn

5223ba5

Fix implicit_provenance_casts warnings on Xous

JonathanBrouwer mentioned this pull request Jul 25, 2026

Rollup of 25 pull requests #159920

Closed

JonathanBrouwer added a commit to JonathanBrouwer/rust that referenced this pull request Jul 25, 2026

Rollup merge of rust-lang#159174 - bjorn3:fix_xous_warnings, r=Darksonn

6943707

Fix implicit_provenance_casts warnings on Xous

JonathanBrouwer mentioned this pull request Jul 25, 2026

Rollup of 25 pull requests #159926

Closed

jhpratt added a commit to jhpratt/rust that referenced this pull request Jul 26, 2026

Rollup merge of rust-lang#159174 - bjorn3:fix_xous_warnings, r=Darksonn

256a9cc

Fix implicit_provenance_casts warnings on Xous

This was referenced Jul 26, 2026

Rollup of 25 pull requests #159941

Closed

Rollup of 25 pull requests #159942

Merged

rust-bors Bot merged commit c04954f into rust-lang:main Jul 26, 2026
13 of 14 checks passed

rustbot added this to the 1.99.0 milestone Jul 26, 2026

rust-timer added a commit that referenced this pull request Jul 26, 2026

Unrolled build for #159174

3969a1a

Rollup merge of #159174 - bjorn3:fix_xous_warnings, r=Darksonn Fix implicit_provenance_casts warnings on Xous

Uh oh!

Uh oh!

Conversation

bjorn3 commented Jul 12, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Jul 12, 2026

Uh oh!

bjorn3 commented Jul 12, 2026

Uh oh!

xobs commented Jul 12, 2026

Uh oh!

Uh oh!

RalfJung commented Jul 12, 2026

Uh oh!

bjorn3 commented Jul 12, 2026

Uh oh!

xobs commented Jul 12, 2026

Uh oh!

RalfJung commented Jul 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clarfonthey commented Jul 12, 2026

Uh oh!

rustbot commented Jul 12, 2026

Uh oh!

RalfJung commented Jul 12, 2026

Uh oh!

RalfJung commented Jul 17, 2026

Uh oh!

bjorn3 commented Jul 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RalfJung commented Jul 20, 2026

Uh oh!

Darksonn Jul 25, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

bjorn3 Jul 25, 2026

Choose a reason for hiding this comment

Uh oh!

Darksonn left a comment • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rust-bors Bot commented Jul 25, 2026

Uh oh!

rust-bors Bot commented Jul 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JonathanBrouwer commented Jul 25, 2026

Uh oh!

rust-bors Bot commented Jul 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

bjorn3 commented Jul 12, 2026 •

edited by rustbot

Loading

RalfJung commented Jul 12, 2026 •

edited

Loading

bjorn3 commented Jul 20, 2026 •

edited

Loading

Darksonn Jul 25, 2026 •

edited by rustbot

Loading

Darksonn left a comment •

edited by rustbot

Loading

rust-bors Bot commented Jul 25, 2026 •

edited

Loading