Re: [RFC PATCH v3 3/5] rust: io_uring: introduce rust abstraction for io-uring cmd

["Benno Lossin" <lossin@kernel.org>]

On Thu Aug 28, 2025 at 2:36 AM CEST, Ming Lei wrote:
> On Fri, Aug 22, 2025 at 12:55:53PM +0000, Sidong Yang wrote:
>> +    /// Reads protocol data unit as `T` that impl `FromBytes` from uring cmd
>> +    ///
>> +    /// Fails with [`EFAULT`] if size of `T` is bigger than pdu size.
>> +    #[inline]
>> +    pub fn read_pdu<T: FromBytes>(&self) -> Result<T> {
>> +        // SAFETY: `self.inner` is guaranteed by the type invariant to point
>> +        // to a live `io_uring_cmd`, so dereferencing is safe.
>> +        let inner = unsafe { &mut *self.inner.get() };
>> +
>> +        let len = size_of::<T>();
>> +        if len > inner.pdu.len() {
>> +            return Err(EFAULT);
>> +        }
>> +
>> +        let mut out: MaybeUninit<T> = MaybeUninit::uninit();
>> +        let ptr = &raw mut inner.pdu as *const c_void;
>> +
>> +        // SAFETY:
>> +        // * The `ptr` is valid pointer from `self.inner` that is guaranteed by type invariant.
>> +        // * The `out` is valid pointer that points `T` which impls `FromBytes` and checked
>> +        //   size of `T` is smaller than pdu size.
>> +        unsafe {
>> +            core::ptr::copy_nonoverlapping(ptr, out.as_mut_ptr().cast::<c_void>(), len);
>> +        }
>> +
>> +        // SAFETY: The read above has initialized all bytes in `out`, and since `T` implements
>> +        // `FromBytes`, any bit-pattern is a valid value for this type.
>> +        Ok(unsafe { out.assume_init() })
>> +    }
>> +
>> +    /// Writes the provided `value` to `pdu` in uring_cmd `self`
>> +    ///
>> +    /// Fails with [`EFAULT`] if size of `T` is bigger than pdu size.
>> +    #[inline]
>> +    pub fn write_pdu<T: AsBytes>(&mut self, value: &T) -> Result<()> {
>> +        // SAFETY: `self.inner` is guaranteed by the type invariant to point
>> +        // to a live `io_uring_cmd`, so dereferencing is safe.
>> +        let inner = unsafe { &mut *self.inner.get() };
>> +
>> +        let len = size_of::<T>();
>> +        if len > inner.pdu.len() {
>> +            return Err(EFAULT);
>> +        }
>> +
>> +        let src = (value as *const T).cast::<c_void>();
>> +        let dst = &raw mut inner.pdu as *mut c_void;
>> +
>> +        // SAFETY:
>> +        // * The `src` is points valid memory that is guaranteed by `T` impls `AsBytes`
>> +        // * The `dst` is valid. It's from `self.inner` that is guaranteed by type invariant.
>> +        // * It's safe to copy because size of `T` is no more than len of pdu.
>> +        unsafe {
>> +            core::ptr::copy_nonoverlapping(src, dst, len);
>> +        }
>> +
>> +        Ok(())
>> +    }
>
> pdu is part of IoUringCmd, which is live in the whole uring_cmd lifetime. But
> both read_pdu()/write_pdu() needs copy to read or write any byte in the pdu, which
> is slow and hard to use, it could be more efficient to add two methods to return
> Result<&T> and Result<mut &T> for user to manipulate uring_cmd's pdu.

That can also be useful, but you do need to ensure that the pdu is
aligned to at least the required alignment of `T` for this to be sound.
I also don't follow your argument that reading & writing the pdu is
slow.

---
Cheers,
Benno