From nobody Fri Oct 3 21:53:40 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1659C273803; Mon, 25 Aug 2025 13:26:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756128362; cv=none; b=BczddxA4esZV9vPSo0WieJuo0m+U49Zyekq2XLC1EGXehf+4U+bxePpU2PtC6aJoqWi6L8Gy6ljF3jeNXtitLFUTbXmRF6fNn271TQVdJg3AKcw/fI1qqRhk1pGyP0LJ8dCisYVF6tK0+RFVSTZSawZextdqpXpOxO2muPdb7o8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756128362; c=relaxed/simple; bh=Gg5vS9fldVoRNzNIbY69DFkPnzVFbaRQhfyOKls2PCg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=nenwplQYm/GnUijiOLHykzgvhVjPXQXlwG98m1ipVg5WNkVkIgoa+dnW7BlD9SeeFOAKC87oM6eM26heFskNn/UdHgnN2jspgPc6Omb7Hi9jJctQKFco6VtkVy0ZslzOxdxAtzpVU6fVV8c4Hvolwu5cGRcXZOROCqZ+ZJTifGM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=acSOaKNy; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="acSOaKNy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D452C116D0; Mon, 25 Aug 2025 13:25:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1756128361; bh=Gg5vS9fldVoRNzNIbY69DFkPnzVFbaRQhfyOKls2PCg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=acSOaKNy40sKgOx3xbwjAgjINc1s7oybMSN3h4X3HRXLPmUEV4DvAXbxn3vrPZ0ST jw0+6EqEW4YsVelKblRwqJ9tvTPSdnTN08HDwqyMHJdV5XHuwCA3MzHZExUYLNPdhf NuvK8nrHm7EgpagwN3nXT64NyoMXNRscascHZadO0M7DuxjYeud0lpXVsuWFBnD2/6 p73T3SUb4wGkOtZInFJHj46uhc72bOWMehCuGEY5o7J3BF1drQ4ywaFQdmotnPk7UG XFiXgZr3hlu7T3HPDatcgANVfZb5H4YidE/H5edk7saVsLu3x7J4E4OinFb6e8HiuY XRSZQ6WyqA+zQ== From: Danilo Krummrich To: akpm@linux-foundation.org, ojeda@kernel.org, alex.gaynor@gmail.com, boqun.feng@gmail.com, gary@garyguo.net, bjorn3_gh@protonmail.com, lossin@kernel.org, a.hindborg@kernel.org, aliceryhl@google.com, tmgross@umich.edu, abdiel.janulgue@gmail.com, acourbot@nvidia.com, jgg@ziepe.ca, lyude@redhat.com, robin.murphy@arm.com, daniel.almeida@collabora.com Cc: rust-for-linux@vger.kernel.org, linux-kernel@vger.kernel.org, Danilo Krummrich Subject: [PATCH v3 3/5] rust: scatterlist: Add abstraction for sg_table Date: Mon, 25 Aug 2025 15:24:42 +0200 Message-ID: <20250825132539.122412-4-dakr@kernel.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20250825132539.122412-1-dakr@kernel.org> References: <20250825132539.122412-1-dakr@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add a safe Rust abstraction for the kernel's scatter-gather list facilities (`struct scatterlist` and `struct sg_table`). This commit introduces `SGTable`, a wrapper that uses a generic parameter to provide compile-time guarantees about ownership and lifetime. The abstraction provides two primary states: - `SGTable>`: Represents a table whose resources are fully managed by Rust. It takes ownership of a page provider `P`, allocates the underlying `struct sg_table`, maps it for DMA, and handles all cleanup automatically upon drop. The DMA mapping's lifetime is tied to the associated device using `Devres`, ensuring it is correctly unmapped before the device is unbound. - `SGTable` (or just `SGTable`): A zero-cost representation of an externally managed `struct sg_table`. It is created from a raw pointer using `SGTable::as_ref()` and provides a lifetime-bound reference (`&'a SGTable`) for operations like iteration. The API exposes a safe iterator that yields `&SGEntry` references, allowing drivers to easily access the DMA address and length of each segment in the list. Co-developed-by: Abdiel Janulgue Signed-off-by: Abdiel Janulgue Signed-off-by: Danilo Krummrich Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Tested-by: Alexandre Courbot --- rust/helpers/helpers.c | 1 + rust/helpers/scatterlist.c | 24 ++ rust/kernel/lib.rs | 1 + rust/kernel/scatterlist.rs | 483 +++++++++++++++++++++++++++++++++++++ 4 files changed, 509 insertions(+) create mode 100644 rust/helpers/scatterlist.c create mode 100644 rust/kernel/scatterlist.rs diff --git a/rust/helpers/helpers.c b/rust/helpers/helpers.c index 7cf7fe95e41d..e94542bf6ea7 100644 --- a/rust/helpers/helpers.c +++ b/rust/helpers/helpers.c @@ -39,6 +39,7 @@ #include "rcu.c" #include "refcount.c" #include "regulator.c" +#include "scatterlist.c" #include "security.c" #include "signal.c" #include "slab.c" diff --git a/rust/helpers/scatterlist.c b/rust/helpers/scatterlist.c new file mode 100644 index 000000000000..80c956ee09ab --- /dev/null +++ b/rust/helpers/scatterlist.c @@ -0,0 +1,24 @@ +// SPDX-License-Identifier: GPL-2.0 + +#include + +dma_addr_t rust_helper_sg_dma_address(struct scatterlist *sg) +{ + return sg_dma_address(sg); +} + +unsigned int rust_helper_sg_dma_len(struct scatterlist *sg) +{ + return sg_dma_len(sg); +} + +struct scatterlist *rust_helper_sg_next(struct scatterlist *sg) +{ + return sg_next(sg); +} + +void rust_helper_dma_unmap_sgtable(struct device *dev, struct sg_table *sg= t, + enum dma_data_direction dir, unsigned long attrs) +{ + return dma_unmap_sgtable(dev, sgt, dir, attrs); +} diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs index ed53169e795c..55acbc893736 100644 --- a/rust/kernel/lib.rs +++ b/rust/kernel/lib.rs @@ -113,6 +113,7 @@ pub mod rbtree; pub mod regulator; pub mod revocable; +pub mod scatterlist; pub mod security; pub mod seq_file; pub mod sizes; diff --git a/rust/kernel/scatterlist.rs b/rust/kernel/scatterlist.rs new file mode 100644 index 000000000000..e76e5c2cbdc7 --- /dev/null +++ b/rust/kernel/scatterlist.rs @@ -0,0 +1,483 @@ +// SPDX-License-Identifier: GPL-2.0 + +//! Abstractions for scatter-gather lists. +//! +//! C header: [`include/linux/scatterlist.h`](srctree/include/linux/scatte= rlist.h) +//! +//! Scatter-gather (SG) I/O is a memory access technique that allows devic= es to perform DMA +//! operations on data buffers that are not physically contiguous in memor= y. It works by creating a +//! "scatter-gather list", an array where each entry specifies the address= and length of a +//! physically contiguous memory segment. +//! +//! The device's DMA controller can then read this list and process the se= gments sequentially as +//! part of one logical I/O request. This avoids the need for a single, la= rge, physically contiguous +//! memory buffer, which can be difficult or impossible to allocate. +//! +//! This module provides safe Rust abstractions over the kernel's `struct = scatterlist` and +//! `struct sg_table` types. +//! +//! The main entry point is the [`SGTable`] type, which represents a compl= ete scatter-gather table. +//! It can be either: +//! +//! - An owned table ([`SGTable>`]), created from a Rust memory b= uffer (e.g., [`VVec`]). +//! This type manages the allocation of the `struct sg_table`, the DMA m= apping of the buffer, and +//! the automatic cleanup of all resources. +//! - A borrowed reference (&[`SGTable`]), which provides safe, read-only = access to a table that was +//! allocated by other (e.g., C) code. +//! +//! Individual entries in the table are represented by [`SGEntry`], which = can be accessed by +//! iterating over an [`SGTable`]. + +use crate::{ + alloc, + alloc::allocator::VmallocPageIter, + bindings, + device::{Bound, Device}, + devres::Devres, + dma, error, + io::resource::ResourceSize, + page, + prelude::*, + types::{ARef, Opaque}, +}; +use core::{ops::Deref, ptr::NonNull}; + +/// A single entry in a scatter-gather list. +/// +/// An `SGEntry` represents a single, physically contiguous segment of mem= ory that has been mapped +/// for DMA. +/// +/// Instances of this struct are obtained by iterating over an [`SGTable`]= . Drivers do not create +/// or own [`SGEntry`] objects directly. +#[repr(transparent)] +pub struct SGEntry(Opaque); + +// SAFETY: `SGEntry` can be send to any task. +unsafe impl Send for SGEntry {} + +// SAFETY: `SGEntry` can be accessed concurrently. +unsafe impl Sync for SGEntry {} + +impl SGEntry { + /// Convert a raw `struct scatterlist *` to a `&'a SGEntry`. + /// + /// # Safety + /// + /// Callers must ensure that the `struct scatterlist` pointed to by `p= tr` is valid for the + /// lifetime `'a`. + #[inline] + unsafe fn from_raw<'a>(ptr: *mut bindings::scatterlist) -> &'a Self { + // SAFETY: The safety requirements of this function guarantee that= `ptr` is a valid pointer + // to a `struct scatterlist` for the duration of `'a`. + unsafe { &*ptr.cast() } + } + + /// Obtain the raw `struct scatterlist *`. + #[inline] + fn as_raw(&self) -> *mut bindings::scatterlist { + self.0.get() + } + + /// Returns the DMA address of this SG entry. + /// + /// This is the address that the device should use to access the memor= y segment. + #[inline] + pub fn dma_address(&self) -> dma::DmaAddress { + // SAFETY: `self.as_raw()` is a valid pointer to a `struct scatter= list`. + unsafe { bindings::sg_dma_address(self.as_raw()) } + } + + /// Returns the length of this SG entry in bytes. + #[inline] + pub fn dma_len(&self) -> ResourceSize { + #[allow(clippy::useless_conversion)] + // SAFETY: `self.as_raw()` is a valid pointer to a `struct scatter= list`. + unsafe { bindings::sg_dma_len(self.as_raw()) }.into() + } +} + +/// The borrowed type state of an [`SGTable`], representing a borrowed or = externally managed table. +#[repr(transparent)] +pub struct Borrowed(Opaque); + +// SAFETY: `Borrowed` can be send to any task. +unsafe impl Send for Borrowed {} + +// SAFETY: `Borrowed` can be accessed concurrently. +unsafe impl Sync for Borrowed {} + +/// A scatter-gather table. +/// +/// This struct is a wrapper around the kernel's `struct sg_table`. It man= ages a list of DMA-mapped +/// memory segments that can be passed to a device for I/O operations. +/// +/// The generic parameter `T` is used as a type state to distinguish betwe= en owned and borrowed +/// tables. +/// +/// - [`SGTable`]: An owned table created and managed entirely by = Rust code. It handles +/// allocation, DMA mapping, and cleanup of all associated resources. S= ee [`SGTable::new`]. +/// - [`SGTable`} (or simply [`SGTable`]): Represents a table w= hose lifetime is managed +/// externally. It can be used safely via a borrowed reference `&'a SGT= able`, where `'a` is the +/// external lifetime. +/// +/// All [`SGTable`] variants can be iterated over the individual [`SGEntry= `]s. +#[repr(transparent)] +#[pin_data] +pub struct SGTable { + #[pin] + inner: T, +} + +impl SGTable { + /// Creates a borrowed `&'a SGTable` from a raw `struct sg_table` poin= ter. + /// + /// This allows safe access to an `sg_table` that is managed elsewhere= (for example, in C code). + /// + /// # Safety + /// + /// Callers must ensure that: + /// + /// - the `struct sg_table` pointed to by `ptr` is valid for the entir= e lifetime of `'a`, + /// - the data behind `ptr` is not modified concurrently for the durat= ion of `'a`. + #[inline] + pub unsafe fn from_raw<'a>(ptr: *mut bindings::sg_table) -> &'a Self { + // SAFETY: The safety requirements of this function guarantee that= `ptr` is a valid pointer + // to a `struct sg_table` for the duration of `'a`. + unsafe { &*ptr.cast() } + } + + #[inline] + fn as_raw(&self) -> *mut bindings::sg_table { + self.inner.0.get() + } + + /// Returns an [`SGTableIter`] bound to the lifetime of `self`. + pub fn iter(&self) -> SGTableIter<'_> { + // SAFETY: `self.as_raw()` is a valid pointer to a `struct sg_tabl= e`. + let nents =3D unsafe { (*self.as_raw()).nents }; + + let pos =3D if nents > 0 { + // SAFETY: `self.as_raw()` is a valid pointer to a `struct sg_= table`. + let ptr =3D unsafe { (*self.as_raw()).sgl }; + + // SAFETY: `ptr` is guaranteed to be a valid pointer to a `str= uct scatterlist`. + Some(unsafe { SGEntry::from_raw(ptr) }) + } else { + None + }; + + SGTableIter { pos, nents } + } +} + +/// Represents the DMA mapping state of a `struct sg_table`. +/// +/// This is used as an inner type of [`Owned`] to manage the DMA mapping l= ifecycle. +/// +/// # Invariants +/// +/// - `sgt` is a valid pointer to a `struct sg_table` for the entire lifet= ime of the +/// [`DmaMappedSgt`]. +/// - `sgt` is always DMA mapped. +struct DmaMappedSgt { + sgt: NonNull, + dev: ARef, + dir: dma::DataDirection, +} + +// SAFETY: `DmaMappedSgt` can be send to any task. +unsafe impl Send for DmaMappedSgt {} + +// SAFETY: `DmaMappedSgt` can be accessed concurrently. +unsafe impl Sync for DmaMappedSgt {} + +impl DmaMappedSgt { + /// # Safety + /// + /// - `sgt` must be a valid pointer to a `struct sg_table` for the ent= ire lifetime of the + /// returned [`DmaMappedSgt`]. + /// - The caller must guarantee that `sgt` remains DMA mapped for the = entire lifetime of + /// [`DmaMappedSgt`]. + unsafe fn new( + sgt: NonNull, + dev: &Device, + dir: dma::DataDirection, + ) -> Result { + // SAFETY: + // - `dev.as_raw()` is a valid pointer to a `struct device`, which= is guaranteed to be + // bound to a driver for the duration of this call. + // - `sgt` is a valid pointer to a `struct sg_table`. + error::to_result(unsafe { + bindings::dma_map_sgtable(dev.as_raw(), sgt.as_ptr(), dir.into= (), 0) + })?; + + // INVARIANT: By the safety requirements of this function it is gu= aranteed that `sgt` is + // valid for the entire lifetime of this object instance. + Ok(Self { + sgt, + dev: dev.into(), + dir, + }) + } +} + +impl Drop for DmaMappedSgt { + #[inline] + fn drop(&mut self) { + // SAFETY: + // - `self.dev.as_raw()` is a pointer to a valid `struct device`. + // - `self.dev` is the same device the mapping has been created fo= r in `Self::new()`. + // - `self.sgt.as_ptr()` is a valid pointer to a `struct sg_table`= by the type invariants + // of `Self`. + // - `self.dir` is the same `dma::DataDirection` the mapping has b= een created with in + // `Self::new()`. + unsafe { + bindings::dma_unmap_sgtable(self.dev.as_raw(), self.sgt.as_ptr= (), self.dir.into(), 0) + }; + } +} + +#[repr(transparent)] +#[pin_data(PinnedDrop)] +struct RawSGTable { + #[pin] + sgt: Opaque, +} + +// SAFETY: `RawSGTable` can be send to any task. +unsafe impl Send for RawSGTable {} + +// SAFETY: `RawSGTable` can be accessed concurrently. +unsafe impl Sync for RawSGTable {} + +impl RawSGTable { + fn new( + pages: &mut [*mut bindings::page], + size: usize, + max_segment: u32, + flags: alloc::Flags, + ) -> impl PinInit + '_ { + try_pin_init!(Self { + sgt <- Opaque::try_ffi_init(|slot: *mut bindings::sg_table| { + // `sg_alloc_table_from_pages_segment()` expects at least = one page, otherwise it + // produces a NPE. + if pages.is_empty() { + return Err(EINVAL); + } + + // SAFETY: + // - `slot` is a valid pointer to uninitialized memory. + // - As by the check above, `pages` is not empty. + error::to_result(unsafe { + bindings::sg_alloc_table_from_pages_segment( + slot, + pages.as_mut_ptr(), + pages.len().try_into()?, + 0, + size, + max_segment, + flags.as_raw(), + ) + }) + }), + }) + } + + #[inline] + fn as_raw(&self) -> *mut bindings::sg_table { + self.sgt.get() + } +} + +#[pinned_drop] +impl PinnedDrop for RawSGTable { + #[inline] + fn drop(self: Pin<&mut Self>) { + // SAFETY: `sgt` is a valid and initialized `struct sg_table`. + unsafe { bindings::sg_free_table(self.sgt.get()) }; + } +} + +/// The [`Owned`] type state of an [`SGTable`]. +/// +/// A [`SGTable`] signifies that the [`SGTable`] owns all associate= d resources: +/// +/// - The backing memory pages. +/// - The `struct sg_table` allocation (`sgt`). +/// - The DMA mapping, managed through a [`Devres`]-managed `DmaMappedSgt`. +/// +/// Users interact with this type through the [`SGTable`] handle and do no= t need to manage +/// [`Owned`] directly. +#[pin_data] +pub struct Owned

{ + // Note: The drop order is relevant; we first have to unmap the `struc= t sg_table`, then free the + // `struct sg_table` and finally free the backing pages. + #[pin] + dma: Devres, + #[pin] + sgt: RawSGTable, + _pages: P, +} + +// SAFETY: `Owned` can be send to any task if `P` can be send to any task. +unsafe impl Send for Owned

{} + +// SAFETY: `Owned` can be accessed concurrently if `P` can be accessed con= currently. +unsafe impl Sync for Owned

{} + +impl

Owned

+where + for<'a> P: page::AsPageIter =3D VmallocPageIter<'a>> + 'stati= c, +{ + fn new( + dev: &Device, + mut pages: P, + dir: dma::DataDirection, + flags: alloc::Flags, + ) -> Result + '_> { + let page_iter =3D pages.page_iter(); + let size =3D page_iter.size(); + + let mut page_vec: KVec<*mut bindings::page> =3D + KVec::with_capacity(page_iter.page_count(), flags)?; + + for page in page_iter { + page_vec.push(page.as_ptr(), flags)?; + } + + // `dma_max_mapping_size` returns `size_t`, but `sg_alloc_table_fr= om_pages_segment()` takes + // an `unsigned int`. + // + // SAFETY: `dev.as_raw()` is a valid pointer to a `struct device`. + let max_segment =3D match unsafe { bindings::dma_max_mapping_size(= dev.as_raw()) } { + 0 =3D> u32::MAX, + max_segment =3D> u32::try_from(max_segment).unwrap_or(u32::MAX= ), + }; + + Ok(try_pin_init!(&this in Self { + sgt <- RawSGTable::new(&mut page_vec, size, max_segment, flags= ), + dma <- { + // SAFETY: `this` is a valid pointer to uninitialized memo= ry. + let sgt =3D unsafe { &raw mut (*this.as_ptr()).sgt }.cast(= ); + + // SAFETY: `sgt` is guaranteed to be non-null. + let sgt =3D unsafe { NonNull::new_unchecked(sgt) }; + + // SAFETY: + // - It is guaranteed that the object returned by `DmaMapp= edSgt::new` won't out-live + // `sgt`. + // - `sgt` is never DMA unmapped manually. + Devres::new(dev, unsafe { DmaMappedSgt::new(sgt, dev, dir)= }) + }, + _pages: pages, + })) + } +} + +impl

SGTable> +where + for<'a> P: page::AsPageIter =3D VmallocPageIter<'a>> + 'stati= c, +{ + /// Allocates a new scatter-gather table from the given pages and maps= it for DMA. + /// + /// This constructor creates a new [`SGTable`] that takes owner= ship of `P`. + /// It allocates a `struct sg_table`, populates it with entries corres= ponding to the physical + /// pages of `P`, and maps the table for DMA with the specified [`Devi= ce`] and + /// [`dma::DataDirection`]. + /// + /// The DMA mapping is managed through [`Devres`], ensuring that the D= MA mapping is unmapped + /// once the associated [`Device`] is unbound, or when the [`SGTable`] is dropped. + /// + /// # Parameters + /// + /// * `dev`: The [`Device`] that will be performing the DMA. + /// * `pages`: The entity providing the backing pages. It must impleme= nt [`page::AsPageIter`]. + /// The ownership of this entity is moved into the new [`SGTable`]. + /// * `dir`: The [`dma::DataDirection`] of the DMA transfer. + /// * `flags`: Allocation flags for internal allocations (e.g., [`GFP_= KERNEL`]). + /// + /// # Examples + /// + /// ``` + /// use kernel::{ + /// device::{Bound, Device}, + /// dma, page, + /// prelude::*, + /// scatterlist::{SGTable, Owned}, + /// }; + /// + /// fn test(dev: &Device) -> Result { + /// let size =3D 4 * page::PAGE_SIZE; + /// let pages =3D VVec::::with_capacity(size, GFP_KERNEL)?; + /// + /// let sgt =3D KBox::pin_init(SGTable::new( + /// dev, + /// pages, + /// dma::DataDirection::ToDevice, + /// GFP_KERNEL, + /// ), GFP_KERNEL)?; + /// + /// Ok(()) + /// } + /// ``` + pub fn new( + dev: &Device, + pages: P, + dir: dma::DataDirection, + flags: alloc::Flags, + ) -> impl PinInit + '_ { + try_pin_init!(Self { + inner <- Owned::new(dev, pages, dir, flags)? + }) + } +} + +impl

Deref for SGTable> { + type Target =3D SGTable; + + #[inline] + fn deref(&self) -> &Self::Target { + // SAFETY: + // - `self.inner.sgt.as_raw()` is a valid pointer to a `struct sg_= table` for the entire + // lifetime of `self`. + // - The backing `struct sg_table` is not modified for the entire = lifetime of `self`. + unsafe { SGTable::from_raw(self.inner.sgt.as_raw()) } + } +} + +mod private { + pub trait Sealed {} + + impl Sealed for super::Borrowed {} + impl

Sealed for super::Owned

{} +} + +/// An [`Iterator`] over the DMA mapped [`SGEntry`] items of an [`SGTable`= ]. +/// +/// Note that the existence of an [`SGTableIter`] does not guarantee that = the [`SGEntry`] items +/// actually remain DMA mapped; they are prone to be unmapped on device un= bind. +pub struct SGTableIter<'a> { + pos: Option<&'a SGEntry>, + /// The number of DMA mapped entries in a `struct sg_table`. + nents: c_uint, +} + +impl<'a> Iterator for SGTableIter<'a> { + type Item =3D &'a SGEntry; + + fn next(&mut self) -> Option { + let entry =3D self.pos?; + self.nents =3D self.nents.saturating_sub(1); + + // SAFETY: `entry.as_raw()` is a valid pointer to a `struct scatte= rlist`. + let next =3D unsafe { bindings::sg_next(entry.as_raw()) }; + + self.pos =3D (!next.is_null() && self.nents > 0).then(|| { + // SAFETY: If `next` is not NULL, `sg_next()` guarantees to re= turn a valid pointer to + // the next `struct scatterlist`. + unsafe { SGEntry::from_raw(next) } + }); + + Some(entry) + } +} --=20 2.51.0