Re: [PATCH 1/8] rust: firmware: add request_into_buf()

["Danilo Krummrich" <dakr@kernel.org>]

On Thu Jun 11, 2026 at 6:32 PM CEST, Timur Tabi wrote:
> On Thu, 2026-06-11 at 15:49 +0900, Alexandre Courbot wrote:
>> > +/// the caller could mutate `buf` while reads via `data()` are outstanding (and
>> > +/// `release_firmware()` does not free `buf` anyway). Releasing the bookkeeping here and
>> > +/// returning only the size leaves `buf` as the single owner and accessor of the data.
>> > +pub fn request_into_buf(name: &CStr, dev: &Device, buf: &mut [u8]) -> Result<usize> {
>> 
>> By adding a lifetime parameter you can return a `Result<&'a mut [u8]>`.
>> This is more sound as the caller cannot use the unwritten part of `buf`.
>> It is also more convenient as there is now no need to create a sub-slice
>> manually.
>
> Sorry, I don't understand.  The caller allocates the buffer any way it wants and passes the
> slice.  This function is basically a gloried memcpy, it doesn't care about lifetimes.  Why would
> I want to add one?  It even releases the `firmware` object before it exits, so there's no
> kernel-allocated data to retain, which is why it's not part of the Firmware struct.

It allows you to return a &'a mut [u8], where this is a sub-slice that is
already "trimmed" to the length of the actual firmware image loaded. This way
callers do not need to bother creating a sub-slice themselves.

The lifetime is required to tell the compiler which argument to infer the output
lifetime from.

	 fn request_into_buf<'a>(name: &CStr, dev: &Device, buf: &'a mut [u8]) -> Result<&'a mut [u8]>

This tells the compiler that the returned sub-slice must not outlive buf. Note
that the compiler does only look at the signature, not the function body.


>> "the caller cannot use the unwritten part of `buf`"
>
> Sure it can.  It allocated the buffer, and passed a slice of the whole buffer or just a portion.
> After the function returns, the caller can do whatever it wants with the buffer, since it owns
> it outright.

True, but there is no reason for the caller to create the sub-slice on its own
anymore, i.e. the correct usage becomes the "path of least resistance".