Re: [PATCH v2 04/11] rust: io: add missing safety requirement in `IoCapable` methods

Andreas Hindborg
2026-04-28T09:02:48Z

Gary Guo <gary@garyguo.net> writes:

> The current safety comment on `io_read`/`io_write` does not cover the topic
> about alignment, although this is guaranteed by checks in `Io`. Add it so
> it can be relied on by implementor of `IoCapable`.
>
> Signed-off-by: Gary Guo <gary@garyguo.net>
> ---
> rust/kernel/io.rs | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
> index 1682f2a0d20d..c6d30c5b4e10 100644
> --- a/rust/kernel/io.rs
> +++ b/rust/kernel/io.rs
> @@ -216,14 +216,16 @@ pub trait IoCapable<T> {
> ///
> /// # Safety
> ///
> - /// The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
> + /// - The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
> + /// - `address` must be aligned.
> unsafe fn io_read(&self, address: *mut T) -> T;
>
> /// Performs an I/O write of `value` at `address`.
> ///
> /// # Safety
> ///
> - /// The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
> + /// - The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
> + /// - `address` must be aligned.
> unsafe fn io_write(&self, value: T, address: *mut T);
> }

You should probably update safety comments at call sites in this patch.
For instance in `Io::try_read`:

let address = self.io_addr::<L::IoType>(location.offset())?;

// SAFETY: `address` has been validated by `io_addr`.
Ok(unsafe { self.io_read(address) }.into())

But the documentation for `io_addr` says nothing about the return value
being aligned:

/// Returns the absolute I/O address for a given `offset`,
/// performing runtime bound checks.

Best regards,
Andreas Hindborg