Re: [PATCH v5 0/4] rust: byte-wise atomic copies between `Page` and shared memory

[Andreas Hindborg <a.hindborg@kernel.org>]

Peter Zijlstra <peterz@infradead.org> writes:

> On Tue, Nov 10, 2026 at 03:44:18PM +0100, Andreas Hindborg wrote:
>> This series adds a way to copy data between a `Page` and memory that is
>> shared with actors outside the kernel, such as user space threads or
>> hardware, without introducing a data race.
>> 
>> The copy is built on `SysMem` from `kernel::io`, which already accesses
>> system memory with volatile or byte-wise atomic operations. The series
>> first makes the requirements of `SysMem` explicit by requiring freedom
>> from plain accesses for the lifetime of a view. It then adds
>> `atomic_per_byte_memcpy()`, a wrapper around the kernel's `memcpy()`
>> with explicit safety requirements, and routes the `SysMem` copies
>> through it. Finally, it adds `Page::{read,write}_bytewise_atomic`, which
>> take a `SysMem<'_, [u8]>` view of the shared buffer.
>
> I am still completely confused by this. In what universe is your magical
> atomic_per_byte_memcpy() not memcpy() ?

This Rust function is the C function `memcpy` in all known universes.
The commit message even says so.

There are safety requirements for calling the C `memcpy` from Rust. This
function makes them explicit.

If it helps, we can rename the function so that it is more clear that
this is in fact just `memcpy`. The current name was chosen to encode
some of the semantics of the function in the name.

`atomic_per_byte_memcpy` is different from the "regular" Rust memcpy
function `core::ptr::copy()`. `copre::ptr::copy()` is lowered by llvm
under the assumption of no concurrent accesses to the buffers on either
side of the operation, and so may generate code that is UB in Rust under
concurrent reads or writes. Examples of problems were given in v2.

We need a (Rust) function that can copy data from A to B in the face of
concurrent accesses without producing UB. This patch introduces such a
function, which happens to be just a call to the C `memcpy` function.
Letting every user call `bindings::memcpy` directly would also work, but
then every call site has to discover when that is OK. A Rust function
gives us one place to enumerate the safety requirements

Best regards,
Andreas Hindborg