Re: [PATCH v8 3/7] rust: dma: implement BinaryWriter for CoherentAllocation<u8>

["Alexandre Courbot" <acourbot@nvidia.com>]

On Wed Mar 11, 2026 at 6:59 AM JST, Timur Tabi wrote:
> Implement the BinaryWriter trait for CoherentAllocation<u8>, enabling
> DMA coherent allocations to be exposed as readable binary files.
> The implementation handles offset tracking and bounds checking, copying
> data from the coherent allocation to userspace via write_dma().
>
> Signed-off-by: Timur Tabi <ttabi@nvidia.com>
> ---
>  rust/kernel/dma.rs | 36 +++++++++++++++++++++++++++++++++++-
>  1 file changed, 35 insertions(+), 1 deletion(-)
>
> diff --git a/rust/kernel/dma.rs b/rust/kernel/dma.rs
> index 909d56fd5118..b1cc39756dd8 100644
> --- a/rust/kernel/dma.rs
> +++ b/rust/kernel/dma.rs
> @@ -5,12 +5,14 @@
>  //! C header: [`include/linux/dma-mapping.h`](srctree/include/linux/dma-mapping.h)
>  
>  use crate::{
> -    bindings, build_assert, device,
> +    bindings, build_assert, debugfs, device,
>      device::{Bound, Core},
>      error::{to_result, Result},
> +    fs::file,
>      prelude::*,
>      sync::aref::ARef,
>      transmute::{AsBytes, FromBytes},
> +    uaccess::UserSliceWriter,
>  };
>  use core::ptr::NonNull;
>  
> @@ -668,6 +670,38 @@ fn drop(&mut self) {
>  // can be sent to another thread.
>  unsafe impl<T: AsBytes + FromBytes + Send> Send for CoherentAllocation<T> {}
>  
> +// SAFETY: Sharing `&CoherentAllocation` across threads is safe if `T` is `Sync`, because all
> +// methods that access the buffer contents (`field_read`, `field_write`, `as_slice`,
> +// `as_slice_mut`) are `unsafe`, and callers are responsible for ensuring no data races occur.
> +// The safe methods only return metadata or raw pointers whose use requires `unsafe`.
> +unsafe impl<T: AsBytes + FromBytes + Sync> Sync for CoherentAllocation<T> {}
> +
> +impl debugfs::BinaryWriter for CoherentAllocation<u8> {
> +    fn write_to_slice(
> +        &self,
> +        writer: &mut UserSliceWriter,
> +        offset: &mut file::Offset,
> +    ) -> Result<usize> {
> +        if offset.is_negative() {
> +            return Err(EINVAL);
> +        }

Won't the `try_into` right below also reject negative values?

> +
> +        let offset_val: usize = (*offset).try_into().map_err(|_| EINVAL)?;
> +        let len = self.count();
> +
> +        if offset_val >= len {
> +            return Ok(0);
> +        }
> +
> +        let count = (len - offset_val).min(writer.len());

We can simplify a bit:

  let count = self.count().saturating_sub(offset_val).min(writer.len());

That way you can get rid of the `offset_val >= len`` test and the rest
of the code will work with `len == 0`, which will have the desired
effect.

Regardless,

Reviewed-by: Alexandre Courbot <acourbot@nvidia.com>