* [PATCH v6 1/4] rust: io: forbid plain accesses racing with `SysMem`
2026-11-13 13:15 [PATCH v6 0/4] rust: byte-wise atomic copies between `Page` and shared memory Andreas Hindborg
@ 2026-11-13 13:15 ` Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 2/4] rust: sync: atomic: add memcpy Andreas Hindborg
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Andreas Hindborg @ 2026-11-13 13:15 UTC (permalink / raw)
To: Alice Ryhl, Lorenzo Stoakes, Liam R. Howlett, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Trevor Gross, Danilo Krummrich, Will Deacon, Peter Zijlstra,
Mark Rutland, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Lyude Paul, Abdiel Janulgue,
Robin Murphy, David Airlie, Simona Vetter
Cc: linux-mm, rust-for-linux, linux-kernel, driver-core, dri-devel,
Andreas Hindborg
`SysMem` accesses memory with volatile loads and stores and with the
kernel's `memcpy()`. Both are well-defined when racing with hardware or
user space, and when racing with atomic or volatile accesses from other
kernel code. However, if they race with plain, non-atomic accesses from
kernel code, they are considered a data race, and therefore undefined
behavior.
The invariants of `SysMem` only require the region to be valid and
aligned kernel accessible memory. Nothing stops a caller from creating
a `SysMem` over memory that other kernel code accesses with plain loads
and stores at the same time.
Make the requirement explicit. Require that no plain access to the
region races with an access performed through the view, define what a
plain access and a race is, and update the safety comments on the
backend implementation and on the existing callers of `SysMem::new` to
rely on the new invariant.
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
---
rust/kernel/dma.rs | 8 +++++++-
rust/kernel/drm/gem/shmem.rs | 2 ++
rust/kernel/io.rs | 48 +++++++++++++++++++++++++++++---------------
3 files changed, 41 insertions(+), 17 deletions(-)
diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
index 580e1c3427bc..445b5859c60b 100644
--- a/rust/kernel/dma.rs
+++ b/rust/kernel/dma.rs
@@ -1237,7 +1237,13 @@ impl<'a, T: ?Sized + KnownSize> IoBase<'a> for &'a Coherent<'_, T> {
#[inline]
fn as_view(self) -> CoherentView<'a, Self::Target> {
CoherentView {
- // SAFETY: `cpu_addr` is valid and aligned kernel accessible memory.
+ // SAFETY:
+ // - Per type invariant, `cpu_addr` is valid and aligned kernel accessible memory.
+ // - Plain accesses to the region are only possible through `unsafe` APIs, that is
+ // `Coherent::{as_ref,as_mut}`, `CoherentView::{as_ref,as_mut}` and dereferencing
+ // the raw pointers returned by `Coherent::{as_ptr,as_mut_ptr}`, all of which require
+ // the caller to avoid racing with other accesses to the region, including accesses
+ // through this view.
cpu_addr: unsafe { SysMem::new(self.cpu_addr.as_ptr()) },
dma_addr: self.dma_addr,
}
diff --git a/rust/kernel/drm/gem/shmem.rs b/rust/kernel/drm/gem/shmem.rs
index 24cb5343e0db..e55c3d16729d 100644
--- a/rust/kernel/drm/gem/shmem.rs
+++ b/rust/kernel/drm/gem/shmem.rs
@@ -471,6 +471,8 @@ fn as_view(self) -> SysMem<'a, Region<SIZE>> {
// - `addr` is page-aligned, which satisfies `Region`'s 4-byte alignment requirement.
// - The memory remains valid until this `VMap` is dropped; since `self` is `&'a VMap`,
// the borrow prevents the `VMap` from being dropped for the lifetime `'a`.
+ // - `VMap` does not expose the mapping in any other way, so all accesses to the region
+ // from Rust go through views created here, and those are never plain accesses.
unsafe { SysMem::new(ptr) }
}
}
diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
index a877df11a03e..00bab24d613c 100644
--- a/rust/kernel/io.rs
+++ b/rust/kernel/io.rs
@@ -1452,7 +1452,8 @@ unsafe fn project_view<'a, T: ?Sized + KnownSize, U: ?Sized + KnownSize>(
ptr: *mut U,
) -> Self::View<'a, U> {
// INVARIANT: Per safety requirement, `ptr` is projection from `view`, so it is also a valid
- // kernel accessible memory region.
+ // kernel accessible memory region. Accesses through the new view are accesses through
+ // `view`, which no plain access races with per the invariants of `view`.
SysMem {
ptr,
phantom: PhantomData,
@@ -1470,8 +1471,9 @@ fn io_read(view: SysMem<'_, $ty>) -> $ty {
// SAFETY:
// - Per type invariant, `ptr` is valid and aligned.
// - Using read_volatile() here so that race with hardware is well-defined.
- // - Using read_volatile() here is not sound if it races with other CPU per Rust
- // rules, but this is allowed per LKMM.
+ // - Per type invariant, no plain access races with this read. Racing with atomic
+ // or volatile accesses from other CPUs is not sound per Rust rules, but this is
+ // allowed per LKMM.
// - The macro is only used on primitives so all bit patterns are valid.
unsafe { view.ptr.read_volatile() }
}
@@ -1481,8 +1483,9 @@ fn io_write(view: SysMem<'_, $ty>, value: $ty) {
// SAFETY:
// - Per type invariant, `ptr` is valid and aligned.
// - Using write_volatile() here so that race with hardware is well-defined.
- // - Using write_volatile() here is not sound if it races with other CPU per Rust
- // rules, but this is allowed per LKMM.
+ // - Per type invariant, no plain access races with this write. Racing with atomic
+ // or volatile accesses from other CPUs is not sound per Rust rules, but this is
+ // allowed per LKMM.
unsafe { view.ptr.write_volatile(value) }
}
}
@@ -1519,8 +1522,9 @@ fn copy_read<T: FromBytes>(view: Self::View<'_, T>) -> T {
// SAFETY:
// - Per type invariant, `ptr` is valid and aligned.
// - Using read_volatile() here so that race with hardware is well-defined.
- // - Using read_volatile() here is not sound if it races with other CPU per Rust
- // rules, but this is allowed per LKMM.
+ // - Per type invariant, no plain access races with this read. Racing with atomic or
+ // volatile accesses from other CPUs is not sound per Rust rules, but this is allowed
+ // per LKMM.
// - `T: FromBytes` so all bit patterns are valid.
unsafe { view.ptr.read_volatile() }
}
@@ -1530,22 +1534,32 @@ fn copy_write<T: IntoBytes>(view: Self::View<'_, T>, value: T) {
// SAFETY:
// - Per type invariant, `ptr` is valid and aligned.
// - Using write_volatile() here so that race with hardware is well-defined.
- // - Using write_volatile() here is not sound if it races with other CPU per Rust
- // rules, but this is allowed per LKMM.
+ // - Per type invariant, no plain access races with this write. Racing with atomic or
+ // volatile accesses from other CPUs is not sound per Rust rules, but this is allowed
+ // per LKMM.
unsafe { view.ptr.write_volatile(value) }
}
}
/// A view of a system memory region.
///
-/// Provides `Io` trait implementation for kernel virtual address ranges,
-/// using volatile read/write to safely access shared memory that may be
-/// concurrently accessed by external hardware.
+/// Provides `Io` trait implementation for kernel virtual address ranges, using volatile or
+/// byte-wise atomic accesses to safely access shared memory that may be concurrently accessed by
+/// external actors, such as hardware or user space threads, or by other kernel code using atomic or
+/// volatile accesses.
+///
+/// Accesses through a `SysMem` are never plain accesses. A plain access is a non-atomic,
+/// non-volatile access performed by kernel code, whether in C or in Rust. Two accesses to the same
+/// memory race if at least one of them is a write and they are not ordered by synchronization. A
+/// plain access that races with another access is a data race, and therefore undefined behavior.
+/// Accesses performed by hardware or by user space are not plain accesses in this sense. Racing
+/// with them is well-defined, but the data observed may be arbitrary.
///
/// # Invariants
///
-/// `self.ptr.addr() .. self.ptr.addr() + KnownSize::size(self.ptr)` is valid and aligned kernel
-/// accessible memory region for the lifetime `'a`.
+/// - `self.ptr.addr() .. self.ptr.addr() + KnownSize::size(self.ptr)` is valid and aligned kernel
+/// accessible memory region for the lifetime `'a`.
+/// - No plain access to that memory region races with an access performed through this view.
pub struct SysMem<'a, T: ?Sized> {
ptr: *mut T,
phantom: PhantomData<&'a ()>,
@@ -1570,8 +1584,10 @@ impl<'a, T: ?Sized> SysMem<'a, T> {
///
/// # Safety
///
- /// `ptr.addr() .. ptr.addr() + KnownSize::size(ptr)` must be valid and aligned kernel
- /// accessible memory region for the lifetime `'a`.
+ /// - `ptr.addr() .. ptr.addr() + KnownSize::size(ptr)` must be valid and aligned kernel
+ /// accessible memory region for the lifetime `'a`.
+ /// - No plain access (see [`SysMem`]) to that memory region may race with an access performed
+ /// through the returned view.
#[inline]
pub unsafe fn new(ptr: *mut T) -> Self {
// INVARIANT: Per safety requirement.
--
2.54.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v6 2/4] rust: sync: atomic: add memcpy
2026-11-13 13:15 [PATCH v6 0/4] rust: byte-wise atomic copies between `Page` and shared memory Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 1/4] rust: io: forbid plain accesses racing with `SysMem` Andreas Hindborg
@ 2026-11-13 13:15 ` Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 3/4] rust: io: copy `SysMem` with `atomic::memcpy` Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 4/4] rust: page: add byte-wise atomic copy methods for `SysMem` Andreas Hindborg
3 siblings, 0 replies; 5+ messages in thread
From: Andreas Hindborg @ 2026-11-13 13:15 UTC (permalink / raw)
To: Alice Ryhl, Lorenzo Stoakes, Liam R. Howlett, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Trevor Gross, Danilo Krummrich, Will Deacon, Peter Zijlstra,
Mark Rutland, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Lyude Paul, Abdiel Janulgue,
Robin Murphy, David Airlie, Simona Vetter
Cc: linux-mm, rust-for-linux, linux-kernel, driver-core, dri-devel,
Andreas Hindborg
Add a helper to copy `len` bytes from `src` to `dst` using byte-wise atomic
memory operations. This is the concurrent-safe counterpart of
`core::ptr::copy_nonoverlapping()` (the equivalent of standard C's
`memcpy()`). Because of the atomicity at byte level, when the copy races
with another concurrent atomic access (or when a normal read races with an
atomic read), or with an external access (from DMA or userspace), the
behavior of this function is defined: the memory is copied at (at least)
byte granularity.
The helper is the building block for higher-level copy operations that need
to remain defined under racing accesses, such as the `SysMem` I/O backend,
which copies to and from memory that may be shared with hardware or user
space.
The implementation forwards to the kernel's `memcpy()`, which is
implemented in a way that byte-wise atomic memory load/store instructions
are used.
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
---
rust/kernel/sync/atomic.rs | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
diff --git a/rust/kernel/sync/atomic.rs b/rust/kernel/sync/atomic.rs
index 6d27898add42..d25627fa6557 100644
--- a/rust/kernel/sync/atomic.rs
+++ b/rust/kernel/sync/atomic.rs
@@ -848,3 +848,39 @@ pub unsafe fn cmpxchg<T: AtomicType, Ordering: ordering::Ordering>(
// per LKMM.
unsafe { Atomic::from_ptr(ptr) }.cmpxchg(old, new, o)
}
+
+/// Copy `len` bytes from `src` to `dst` using byte-wise atomic operations.
+///
+/// This is the concurrent-safe counterpart of `core::ptr::copy_nonoverlapping()` (the equivalent
+/// of standard C's `memcpy()`). Because of the atomicity at byte level, when racing with another
+/// concurrent atomic access (or when a normal read races with an atomic read), or with an external
+/// access (from DMA or userspace), the behavior of this function is defined: the memory is copied
+/// at (at least) byte granularity.
+///
+/// Implementation note: this is currently implemented by the kernel's `memcpy()`, which is
+/// implemented in a way such that byte-wise atomic memory load/store instructions are used.
+///
+/// # Safety
+///
+/// Callers must ensure that:
+///
+/// - `src` is valid for atomic reads for `len` bytes for the duration of the call.
+/// - `dst` is valid for atomic writes for `len` bytes for the duration of the call.
+/// - The memory regions `src .. src + len` and `dst .. dst + len` do not overlap.
+#[inline]
+pub unsafe fn memcpy(src: *const u8, dst: *mut u8, len: usize) {
+ // SAFETY: By the safety requirements of this function, the following operation will not:
+ // - Trap.
+ // - Invalidate any reference invariants.
+ // - Race with any operation by the Rust AM, as `bindings::memcpy` is a byte-wise atomic
+ // operation and all operations by the Rust AM to the involved memory areas use byte-wise
+ // atomic semantics.
+ // - Copy between overlapping regions, which `memcpy()` does not support.
+ unsafe {
+ bindings::memcpy(
+ dst.cast::<kernel::ffi::c_void>(),
+ src.cast::<kernel::ffi::c_void>(),
+ len,
+ )
+ };
+}
--
2.54.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v6 3/4] rust: io: copy `SysMem` with `atomic::memcpy`
2026-11-13 13:15 [PATCH v6 0/4] rust: byte-wise atomic copies between `Page` and shared memory Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 1/4] rust: io: forbid plain accesses racing with `SysMem` Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 2/4] rust: sync: atomic: add memcpy Andreas Hindborg
@ 2026-11-13 13:15 ` Andreas Hindborg
2026-11-13 13:15 ` [PATCH v6 4/4] rust: page: add byte-wise atomic copy methods for `SysMem` Andreas Hindborg
3 siblings, 0 replies; 5+ messages in thread
From: Andreas Hindborg @ 2026-11-13 13:15 UTC (permalink / raw)
To: Alice Ryhl, Lorenzo Stoakes, Liam R. Howlett, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Trevor Gross, Danilo Krummrich, Will Deacon, Peter Zijlstra,
Mark Rutland, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Lyude Paul, Abdiel Janulgue,
Robin Murphy, David Airlie, Simona Vetter
Cc: linux-mm, rust-for-linux, linux-kernel, driver-core, dri-devel,
Andreas Hindborg
The `IoCopyable` implementation for `SysMemBackend` calls
`bindings::memcpy()` directly. The comments say that this is done "for
volatile", but the requirements of the call are not stated anywhere.
The reason the call is sound is that the kernel's `memcpy()` is
byte-wise atomic, and that no plain access races with either side of
the copy.
Call `kernel::sync::atomic::memcpy()` instead, so that the requirements
are spelled out at the call site and checked against the invariants of
`SysMem` and the safety requirements of `IoCopyable`.
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
---
rust/kernel/io.rs | 25 ++++++++++++++++---------
1 file changed, 16 insertions(+), 9 deletions(-)
diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
index 00bab24d613c..76904c63eb0a 100644
--- a/rust/kernel/io.rs
+++ b/rust/kernel/io.rs
@@ -21,7 +21,8 @@
ptr::{
Alignment,
KnownSize, //
- }, //
+ },
+ sync::atomic, //
};
#[cfg(CONFIG_HAS_IOMEM)]
@@ -1501,20 +1502,26 @@ fn io_write(view: SysMem<'_, $ty>, value: $ty) {
impl IoCopyable for SysMemBackend {
#[inline]
unsafe fn copy_from_io(view: Self::View<'_, [u8]>, buffer: *mut u8) {
- // Use `bindings::memcpy` instead of `copy_nonoverlapping` for volatile.
// SAFETY:
- // - `view.ptr` is in CPU address space and valid for read.
- // - `buffer` is valid for write for `view.size()` bytes which is equal to `view.ptr.len()`.
- unsafe { bindings::memcpy(buffer.cast(), view.ptr.cast(), view.ptr.len()) };
+ // - Per type invariant, `view.ptr` is a valid kernel accessible memory region of
+ // `view.ptr.len()` bytes, and no plain access races with this read.
+ // - Per the safety requirements of this function, `buffer` is valid for volatile writes for
+ // `view.size()` bytes, which is equal to `view.ptr.len()`, so it is valid for atomic
+ // writes.
+ // - Per the safety requirements of this function, `buffer` does not overlap with `view`.
+ unsafe { atomic::memcpy(view.ptr.cast(), buffer, view.ptr.len()) };
}
#[inline]
unsafe fn copy_to_io(view: Self::View<'_, [u8]>, buffer: *const u8) {
- // Use `bindings::memcpy` instead of `copy_nonoverlapping` for volatile.
// SAFETY:
- // - `view.ptr` is in CPU address space and valid for write.
- // - `buffer` is valid for read for `view.size()` bytes which is equal to `view.ptr.len()`.
- unsafe { bindings::memcpy(view.ptr.cast(), buffer.cast(), view.ptr.len()) };
+ // - Per the safety requirements of this function, `buffer` is valid for volatile reads for
+ // `view.size()` bytes, which is equal to `view.ptr.len()`, so it is valid for atomic
+ // reads.
+ // - Per type invariant, `view.ptr` is a valid kernel accessible memory region of
+ // `view.ptr.len()` bytes, and no plain access races with this write.
+ // - Per the safety requirements of this function, `buffer` does not overlap with `view`.
+ unsafe { atomic::memcpy(buffer, view.ptr.cast(), view.ptr.len()) };
}
#[inline]
--
2.54.0
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH v6 4/4] rust: page: add byte-wise atomic copy methods for `SysMem`
2026-11-13 13:15 [PATCH v6 0/4] rust: byte-wise atomic copies between `Page` and shared memory Andreas Hindborg
` (2 preceding siblings ...)
2026-11-13 13:15 ` [PATCH v6 3/4] rust: io: copy `SysMem` with `atomic::memcpy` Andreas Hindborg
@ 2026-11-13 13:15 ` Andreas Hindborg
3 siblings, 0 replies; 5+ messages in thread
From: Andreas Hindborg @ 2026-11-13 13:15 UTC (permalink / raw)
To: Alice Ryhl, Lorenzo Stoakes, Liam R. Howlett, Miguel Ojeda,
Boqun Feng, Gary Guo, Björn Roy Baron, Benno Lossin,
Trevor Gross, Danilo Krummrich, Will Deacon, Peter Zijlstra,
Mark Rutland, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Lyude Paul, Abdiel Janulgue,
Robin Murphy, David Airlie, Simona Vetter
Cc: linux-mm, rust-for-linux, linux-kernel, driver-core, dri-devel,
Andreas Hindborg
When copying data between a `Page` and a buffer that is mapped to user
space, or otherwise shared outside the kernel, it is impossible to
guarantee absence of concurrent memory operations on that buffer. Copying
with `Page::{read,write}_raw` would be a data race in that case.
Add `Page::{read,write}_sysmem`, which take a `SysMem` view of the shared
buffer. The accesses to the buffer go through `SysMemBackend`, which uses
byte-wise atomic operations, so they are well-defined when racing with
external actors or with atomic accesses from other kernel code. The page
side of the copy uses plain accesses, so the page itself must not be
accessed concurrently, as is the case for `Page::{read,write}_raw`.
Signed-off-by: Andreas Hindborg <a.hindborg@kernel.org>
---
rust/kernel/page.rs | 121 ++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 121 insertions(+)
diff --git a/rust/kernel/page.rs b/rust/kernel/page.rs
index 1c0796ea229f..e96e95182406 100644
--- a/rust/kernel/page.rs
+++ b/rust/kernel/page.rs
@@ -12,6 +12,12 @@
code::*,
Result, //
},
+ io::{
+ Io,
+ IoCopyable,
+ SysMem,
+ SysMemBackend, //
+ },
uaccess::UserSliceReader, //
};
use core::{
@@ -305,6 +311,58 @@ pub unsafe fn read_raw(&self, dst: *mut u8, offset: usize, len: usize) -> Result
})
}
+ /// Maps the page and reads from it into the given system memory region using byte-wise atomic
+ /// memory operations.
+ ///
+ /// This method will perform bounds checks on the page offset. If `offset .. offset+dst.len()`
+ /// goes outside of the page, then this call returns [`EINVAL`].
+ ///
+ /// The writes to `dst` are byte-wise atomic, so they are well-defined even if `dst` is
+ /// concurrently accessed by hardware, by user space, or by other kernel code using atomic or
+ /// volatile accesses. The reads from the page are plain accesses, so the page must not be
+ /// written to concurrently.
+ ///
+ /// # Safety
+ ///
+ /// Callers must ensure that:
+ ///
+ /// - This call does not race with a write to the source page that overlaps with this read.
+ /// - The memory region of `dst` does not overlap with the memory of the page.
+ ///
+ /// # Examples
+ ///
+ /// ```
+ /// use kernel::{
+ /// io::SysMem,
+ /// page::Page,
+ /// };
+ ///
+ /// let page = Page::alloc_page(GFP_KERNEL | __GFP_ZERO)?;
+ /// let mut buf = [0xffu8; 16];
+ ///
+ /// // SAFETY: `buf` is a local array that outlives `dst`, and it is not accessed in any other
+ /// // way while `dst` is alive.
+ /// let dst = unsafe { SysMem::new(&raw mut buf as *mut [u8]) };
+ ///
+ /// // SAFETY: `page` is not written to during this call, and `buf` is not part of the page.
+ /// unsafe { page.read_sysmem(dst, 0)? };
+ /// assert_eq!(buf, [0u8; 16]);
+ /// # Ok::<(), Error>(())
+ /// ```
+ pub unsafe fn read_sysmem(&self, dst: SysMem<'_, [u8]>, offset: usize) -> Result {
+ self.with_pointer_into_page(offset, dst.len(), move |src| {
+ // SAFETY:
+ // - If `with_pointer_into_page` calls into this closure, then it has performed a
+ // bounds check and guarantees that `src` is valid for `dst.len()` bytes, which is
+ // equal to `dst.size()`.
+ // - By the safety requirements of this function, the page is not written to during
+ // this call, so `src` is valid for volatile reads.
+ // - By the safety requirements of this function, `src` does not overlap with `dst`.
+ unsafe { SysMemBackend::copy_to_io(dst, src) };
+ Ok(())
+ })
+ }
+
/// Maps the page and writes into it from the given buffer.
///
/// This method will perform bounds checks on the page offset. If `offset .. offset+len` goes
@@ -326,6 +384,69 @@ pub unsafe fn write_raw(&self, src: *const u8, offset: usize, len: usize) -> Res
})
}
+ /// Maps the page and writes into it from the given system memory region using byte-wise atomic
+ /// memory operations.
+ ///
+ /// This method will perform bounds checks on the page offset. If `offset .. offset+src.len()`
+ /// goes outside of the page, then this call returns [`EINVAL`].
+ ///
+ /// The reads from `src` are byte-wise atomic, so they are well-defined even if `src` is
+ /// concurrently accessed by hardware, by user space, or by other kernel code using atomic or
+ /// volatile accesses. The writes to the page are plain accesses, so the page must not be read
+ /// from or written to concurrently.
+ ///
+ /// # Safety
+ ///
+ /// Callers must ensure that:
+ ///
+ /// - This call does not race with a read or write to the destination page that overlaps with
+ /// this write.
+ /// - The memory region of `src` does not overlap with the memory of the page.
+ ///
+ /// # Examples
+ ///
+ /// ```
+ /// use kernel::{
+ /// io::SysMem,
+ /// page::Page,
+ /// };
+ ///
+ /// let page = Page::alloc_page(GFP_KERNEL)?;
+ /// let mut data = [0xabu8; 16];
+ /// let mut buf = [0u8; 16];
+ ///
+ /// // SAFETY: `data` and `buf` are local arrays that outlive the views, and they are not
+ /// // accessed in any other way while the views are alive.
+ /// let (src, dst) = unsafe {
+ /// (
+ /// SysMem::new(&raw mut data as *mut [u8]),
+ /// SysMem::new(&raw mut buf as *mut [u8]),
+ /// )
+ /// };
+ ///
+ /// // SAFETY: `page` is not accessed in any other way during these calls, and neither `data`
+ /// // nor `buf` is part of the page.
+ /// unsafe {
+ /// page.write_sysmem(src, 0)?;
+ /// page.read_sysmem(dst, 0)?;
+ /// }
+ /// assert_eq!(buf, data);
+ /// # Ok::<(), Error>(())
+ /// ```
+ pub unsafe fn write_sysmem(&self, src: SysMem<'_, [u8]>, offset: usize) -> Result {
+ self.with_pointer_into_page(offset, src.len(), move |dst| {
+ // SAFETY:
+ // - If `with_pointer_into_page` calls into this closure, then it has performed a
+ // bounds check and guarantees that `dst` is valid for `src.len()` bytes, which is
+ // equal to `src.size()`.
+ // - By the safety requirements of this function, the page is not read from or written
+ // to during this call, so `dst` is valid for volatile writes.
+ // - By the safety requirements of this function, `dst` does not overlap with `src`.
+ unsafe { SysMemBackend::copy_from_io(src, dst) };
+ Ok(())
+ })
+ }
+
/// Maps the page and zeroes the given slice.
///
/// This method will perform bounds checks on the page offset. If `offset .. offset+len` goes
--
2.54.0
^ permalink raw reply [flat|nested] 5+ messages in thread