Re: [PATCH v4 07/20] rust: io: implement `Mmio` as view type

["Gary Guo" <gary@garyguo.net>]

On Tue Jun 16, 2026 at 1:18 AM BST, Alexandre Courbot wrote:
> On Tue Jun 16, 2026 at 12:13 AM JST, Gary Guo wrote:
>>> Is there a reason for not just declaring `RelaxedMmio` as
>>>
>>>     #[repr(transparent)]
>>>     pub struct RelaxedMmio<'a, T: ?Sized>(Mmio<'a, T>);
>>>
>>> similarly to what the original code did with `MmioOwned`?
>>>
>>> I tried locally and could build. This avoids declaring `Mmio` and
>>> `RelaxedMmio` as basically identical types, and lets us remove the
>>> explicit `Send` and `Sync` implementations. IIUC you can also reduce or
>>> even remove the invariant section as it is enforced by `Mmio`.
>>
>> This is what I did originally, but this would cause duplication for
>> RelaxedMmioBackend, as now you have to do
>>
>>      unsafe { bindings::$read_fn(view.0.ptr.cast_const().cast()) }
>>
>> and the `.0` causes the macro not being shared with MmioBackend.
>
> Since `MmioBackend` and `RelaxedMmioBackend` both implement `IoBackend`,
> I think using `IoBackend::as_ptr` in the macro should let you avoid the
> duplication?

Good point. Are you okay with the following diff?

Best,
Gary

diff --git a/rust/kernel/io.rs b/rust/kernel/io.rs
index c6f3ab530b4f..a8da625560a0 100644
--- a/rust/kernel/io.rs
+++ b/rust/kernel/io.rs
@@ -1136,14 +1136,16 @@ macro_rules! impl_mmio_io_capable {
         impl IoCapable<$ty> for $backend {
             #[inline]
             fn io_read(view: <$backend as IoBackend>::View<'_, $ty>) -> $ty {
-                // SAFETY: By the type invariant, `view.ptr` is a valid address for MMIO operations.
-                unsafe { bindings::$read_fn(view.ptr.cast_const().cast()) }
+                // SAFETY: `$backend::as_ptr(view)` is a valid address for MMIO operations for both
+                // `MmioBackend` and `RelaxedMmioBackend`.
+                unsafe { bindings::$read_fn($backend::as_ptr(view).cast_const().cast()) }
             }
 
             #[inline]
             fn io_write(view: <$backend as IoBackend>::View<'_, $ty>, value: $ty) {
-                // SAFETY: By the type invariant, `view.ptr` is a valid address for MMIO operations.
-                unsafe { bindings::$write_fn(value, view.ptr.cast()) }
+                // SAFETY: `$backend::as_ptr(view)` is a valid address for MMIO operations for both
+                // `MmioBackend` and `RelaxedMmioBackend`.
+                unsafe { bindings::$write_fn(value, $backend::as_ptr(view).cast()) }
             }
         }
     };
@@ -1185,14 +1187,7 @@ unsafe fn copy_to_io(view: Self::View<'_, [u8]>, buffer: *const u8) {
 /// the regular ones.
 ///
 /// See [`Mmio::relaxed`] for a usage example.
-///
-/// # Invariant
-///
-/// `ptr` points to a valid and aligned memory-mapped I/O region for the duration lifetime `'a`.
-pub struct RelaxedMmio<'a, T: ?Sized> {
-    ptr: *mut T,
-    phantom: PhantomData<&'a ()>,
-}
+pub struct RelaxedMmio<'a, T: ?Sized>(Mmio<'a, T>);
 
 impl<T: ?Sized> Copy for RelaxedMmio<'_, T> {}
 impl<T: ?Sized> Clone for RelaxedMmio<'_, T> {
@@ -1202,12 +1197,6 @@ fn clone(&self) -> Self {
     }
 }
 
-// SAFETY: `RelaxedMmio<'_, T>` is conceptually `&T` but in I/O memory.
-unsafe impl<T: ?Sized + Sync> Send for RelaxedMmio<'_, T> {}
-
-// SAFETY: `RelaxedMmio<'_, T>` is conceptually `&T` but in I/O memory.
-unsafe impl<T: ?Sized + Sync> Sync for RelaxedMmio<'_, T> {}
-
 /// I/O Backend for memory-mapped I/O, with relaxed access semantics.
 pub struct RelaxedMmioBackend;
 
@@ -1216,20 +1205,16 @@ impl IoBackend for RelaxedMmioBackend {
 
     #[inline]
     fn as_ptr<'a, T: ?Sized + KnownSize>(view: Self::View<'a, T>) -> *mut T {
-        view.ptr
+        MmioBackend::as_ptr(view.0)
     }
 
     #[inline]
     unsafe fn project_view<'a, T: ?Sized + KnownSize, U: ?Sized + KnownSize>(
-        _view: Self::View<'a, T>,
+        view: Self::View<'a, T>,
         ptr: *mut U,
     ) -> Self::View<'a, U> {
-        // INVARIANT: Per safety requirement, `ptr` is projection from `view`, so it is also a valid
-        // memory-mapped I/O region.
-        RelaxedMmio {
-            ptr,
-            phantom: PhantomData,
-        }
+        // SAFETY: Per safety requirement.
+        RelaxedMmio(unsafe { MmioBackend::project_view(view.0, ptr) })
     }
 }
 
@@ -1267,11 +1252,7 @@ impl<'a, T: ?Sized> Mmio<'a, T> {
     /// ```
     #[inline]
     pub fn relaxed(self) -> RelaxedMmio<'a, T> {
-        // INVARIANT: `RelaxedMmio` has the same invariant as `Mmio`.
-        RelaxedMmio {
-            ptr: self.ptr,
-            phantom: PhantomData,
-        }
+        RelaxedMmio(self)
     }
 }