On 1/21/26 8:35 AM, Gary Guo wrote:
> On Wed Dec 3, 2025 at 5:59 AM GMT, John Hubbard wrote:
...
>> + // SAFETY: fmc_full is a valid DmaObject with a contiguous
>> allocation of size() bytes
>> + // starting at start_ptr(). The slice is only used for signature
>> extraction within this
>> + // function scope while fsp_fw remains valid.
>> + let fmc_full_data = unsafe {
>> + core::slice::from_raw_parts(fsp_fw.fmc_full.start_ptr(),
>> fsp_fw.fmc_full.size())
>> + };
>
> The justification is week because it does not mention about the non-race
> nature
> of this, which need to be justified for a DMA allocation. If you use
> `CoherentAllocation::as_slice`, then this requirement would be obvious.
>
> For example:
>
> // SAFETY: the dma buffer is not yet submitted too hardware and we are the
> // unique owner at this point.
> let fmc_full_data = unsafe { fsp_fw.fmc_full.as_slice(0,
> fsp_fw.fmc_full.size()) };
I see. OK, after a lot of fussing over the wording, I'm have come up
with this, which might be much too wordy? I'm not sure.
// SAFETY: fmc_full, which contains the complete FMC ELF file, is never
submitted to
// hardware, so it is safe from hardware-software races. And we are the
unique owner of
// fsp_fw (and therefore of fsp_fw.fmc_full). (A separate buffer,
fsp_fw.fmc_image, is what
// gets submitted to the hardware).
thanks,
--
John Hubbard
