[PATCH v3 02/19] rust: io: add missing safety requirement in `IoCapable` methods

From: Gary Guo

Date: Mon Jun 08 2026 - 16:01:40 EST

The current safety comment on `io_read`/`io_write` does not cover the topic
about alignment. Add it so it can be relied on by implementor of
`IoCapable`.

Expand the check `Io` by taking `self.addr()` into consideration when
checking if `offset` is aligned. For the compile-time `io_addr_assert`
check, check using the known minimum alignment of `IO::Target` and the
accessed type.

Signed-off-by: Gary Guo <gary@xxxxxxxxxxx>
---
rust/kernel/io.rs | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
index dcf3b40ffa48..a58fb9a21dca 100644
--- a/rust/kernel/io.rs
+++ b/rust/kernel/io.rs
@@ -197,13 +197,15 @@ pub fn maxsize(&self) -> usize {
#[repr(transparent)]
pub struct Mmio<const SIZE: usize = 0>(MmioRaw<SIZE>);

-/// Checks whether an access of type `U` at the given `offset`
+/// Checks whether an access of type `U` at the given `base` and the given `offset`
/// is valid within this region.
+///
+/// The `base` is used for alignment checking only. This can be set to 0 to skip the check.
#[inline]
-const fn offset_valid(offset: usize, size: usize) -> bool {
+const fn offset_valid(base: usize, offset: usize, size: usize) -> bool {
let type_size = core::mem::size_of::();
if let Some(end) = offset.checked_add(type_size) {
- end <= size && offset % type_size == 0
+ end <= size && (base.wrapping_add(offset) % type_size == 0)
} else {
false
}
@@ -222,14 +224,16 @@ pub trait IoCapable<T> {
///
/// # Safety
///
- /// The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
+ /// - The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
+ /// - `address` must be aligned.
unsafe fn io_read(&self, address: usize) -> T;

/// Performs an I/O write of `value` at `address`.
///
/// # Safety
///
- /// The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
+ /// - The range `[address..address + size_of::<T>()]` must be within the bounds of `Self`.
+ /// - `address` must be aligned.
unsafe fn io_write(&self, value: T, address: usize);
}

@@ -311,7 +315,11 @@ pub trait Io {
// Always inline to optimize out error path of `build_assert`.
#[inline(always)]
fn io_addr_assert(&self, offset: usize) -> usize {
- build_assert!(offset_valid::(offset, Self::Target::MIN_SIZE));
+ // We cannot check alignment with `offset_valid` using `self.addr()`. So set 0 for it and
+ // ensure alignment by checking that the alignment of `U` is smaller or equal to the
+ // alignment of `Self::Target`.
+ const_assert!(Alignment::of::().as_usize() <= Self::Target::MIN_ALIGN.as_usize());
+ build_assert!(offset_valid::(0, offset, Self::Target::MIN_SIZE));

self.addr() + offset
}
@@ -320,7 +328,7 @@ fn io_addr_assert(&self, offset: usize) -> usize {
/// performing runtime bound checks.
#[inline]
fn io_addr(&self, offset: usize) -> Result<usize> {
- if !offset_valid::(offset, self.maxsize()) {
+ if !offset_valid::(self.addr(), offset, self.maxsize()) {
return Err(EINVAL);
}

--
2.54.0