On 1/23/26 5:38 PM, John Hubbard wrote:
> On 1/21/26 8:35 AM, Gary Guo wrote:
>> On Wed Dec 3, 2025 at 5:59 AM GMT, John Hubbard wrote:
> ...
>>> + // SAFETY: fmc_full is a valid DmaObject with a contiguous
>>> allocation of size() bytes
>>> + // starting at start_ptr(). The slice is only used for signature
>>> extraction within this
>>> + // function scope while fsp_fw remains valid.
>>> + let fmc_full_data = unsafe {
>>> + core::slice::from_raw_parts(fsp_fw.fmc_full.start_ptr(),
>>> fsp_fw.fmc_full.size())
>>> + };
>>
>> The justification is week because it does not mention about the non-race
>> nature
>> of this, which need to be justified for a DMA allocation. If you use
>> `CoherentAllocation::as_slice`, then this requirement would be obvious.
>>
>> For example:
>>
>> // SAFETY: the dma buffer is not yet submitted too hardware and we are
>> the
>> // unique owner at this point.
>> let fmc_full_data = unsafe { fsp_fw.fmc_full.as_slice(0,
>> fsp_fw.fmc_full.size()) };
>
> I see. OK, after a lot of fussing over the wording, I'm have come up
> with this, which might be much too wordy? I'm not sure.
>
> // SAFETY: fmc_full, which contains the complete FMC ELF file, is never
> submitted to
> // hardware, so it is safe from hardware-software races. And we are the
> unique owner of
> // fsp_fw (and therefore of fsp_fw.fmc_full). (A separate buffer,
> fsp_fw.fmc_image, is what
> // gets submitted to the hardware).
>
>
Oh, forget to mention that I also changed it to use .as_slice(), so:
// SAFETY: fmc_full, which contains the complete FMC ELF file, is never
submitted to
// hardware, so it is safe from hardware-software races. And we are the
unique owner of
// fsp_fw (and therefore of fsp_fw.fmc_full). (A separate buffer,
fsp_fw.fmc_image, is what
// gets submitted to the hardware).
let fmc_full_data = unsafe { fsp_fw.fmc_full.as_slice(0,
fsp_fw.fmc_full.size())? };
thanks,
--
John Hubbard
