[PATCH] rust: iommu: add device lifetime to IoPageTable

[PATCH] rust: iommu: add device lifetime to IoPageTable

[Deborah Brouwer]

Currently, using a raw IoPageTable is unsafe because the returned
IoPageTable is not tied to the device driver binding lifetime.

Since device drivers now receive a lifetime parameter <'bound>
representing the interval during which a device driver is bound to its bus
device, add this lifetime parameter to IoPageTable. This ensures that
the returned IoPageTable cannot outlive the bus device binding.

Also temporarily remove the option to create a page table as a device
resource since currently Devres is not compatible with resources that have
a lifetime parameter. This option can be restored once the lifetime-aware
wrapper for devres is available.

Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
 rust/kernel/iommu/pgtable.rs | 32 ++++++++++----------------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/rust/kernel/iommu/pgtable.rs b/rust/kernel/iommu/pgtable.rs
index c88e38fd938a..d4a16283b5a7 100644
--- a/rust/kernel/iommu/pgtable.rs
+++ b/rust/kernel/iommu/pgtable.rs
@@ -16,7 +16,6 @@
         Bound,
         Device, //
     },
-    devres::Devres,
     error::to_result,
     io::PhysAddr,
     prelude::*, //
@@ -59,15 +58,16 @@ pub struct Config {
 /// # Invariants
 ///
 /// The pointer references a valid io page table.
-pub struct IoPageTable<F: IoPageTableFmt> {
+pub struct IoPageTable<'bound, F: IoPageTableFmt> {
     ptr: NonNull<bindings::io_pgtable_ops>,
+    _dev: PhantomData<&'bound Device<Bound>>,
     _marker: PhantomData<F>,
 }
 
 // SAFETY: `struct io_pgtable_ops` is not restricted to a single thread.
-unsafe impl<F: IoPageTableFmt> Send for IoPageTable<F> {}
+unsafe impl<F: IoPageTableFmt> Send for IoPageTable<'_, F> {}
 // SAFETY: `struct io_pgtable_ops` may be accessed concurrently.
-unsafe impl<F: IoPageTableFmt> Sync for IoPageTable<F> {}
+unsafe impl<F: IoPageTableFmt> Sync for IoPageTable<'_, F> {}
 
 /// The format used by this page table.
 pub trait IoPageTableFmt: 'static {
@@ -75,25 +75,12 @@ pub trait IoPageTableFmt: 'static {
     const FORMAT: io_pgtable_fmt;
 }
 
-impl<F: IoPageTableFmt> IoPageTable<F> {
-    /// Create a new `IoPageTable` as a device resource.
-    #[inline]
-    pub fn new(
-        dev: &Device<Bound>,
-        config: Config,
-    ) -> impl PinInit<Devres<IoPageTable<F>>, Error> + '_ {
-        // SAFETY: Devres ensures that the value is dropped during device unbind.
-        Devres::new(dev, unsafe { Self::new_raw(dev, config) })
-    }
+impl<'bound, F: IoPageTableFmt> IoPageTable<'bound, F> {
+    // TODO: Create a new `IoPageTable` as a device resource when DevresLt is available.
 
     /// Create a new `IoPageTable`.
-    ///
-    /// # Safety
-    ///
-    /// If successful, then the returned `IoPageTable` must be dropped before the device is
-    /// unbound.
     #[inline]
-    pub unsafe fn new_raw(dev: &Device<Bound>, config: Config) -> Result<IoPageTable<F>> {
+    pub fn new_raw(dev: &'bound Device<Bound>, config: Config) -> Result<IoPageTable<'bound, F>> {
         let mut raw_cfg = bindings::io_pgtable_cfg {
             quirks: config.quirks,
             pgsize_bitmap: config.pgsize_bitmap,
@@ -118,6 +105,7 @@ pub unsafe fn new_raw(dev: &Device<Bound>, config: Config) -> Result<IoPageTable
         // INVARIANT: We successfully created a valid page table.
         Ok(IoPageTable {
             ptr: NonNull::new(ops).ok_or(ENOMEM)?,
+            _dev: PhantomData,
             _marker: PhantomData,
         })
     }
@@ -240,7 +228,7 @@ extern "C" fn rust_tlb_flush_walk_noop(
 ) {
 }
 
-impl<F: IoPageTableFmt> Drop for IoPageTable<F> {
+impl<F: IoPageTableFmt> Drop for IoPageTable<'_, F> {
     fn drop(&mut self) {
         // SAFETY: The caller of `Self::ttbr()` promised that the page table is not live when this
         // destructor runs.
@@ -255,7 +243,7 @@ impl IoPageTableFmt for ARM64LPAES1 {
     const FORMAT: io_pgtable_fmt = bindings::io_pgtable_fmt_ARM_64_LPAE_S1 as io_pgtable_fmt;
 }
 
-impl IoPageTable<ARM64LPAES1> {
+impl IoPageTable<'_, ARM64LPAES1> {
     /// Access the `ttbr` field of the configuration.
     ///
     /// This is the physical address of the page table, which may be passed to the device that

---
base-commit: dd8a3c6cd531dca5917111a94fa3074077f6ba5a
change-id: 20260702-pgtable_lt_v1-30ef45e019f4

Best regards,
-- 
Deborah Brouwer <deborah.brouwer@collabora.com>

Re: [PATCH] rust: iommu: add device lifetime to IoPageTable

[Alice Ryhl]

On Thu, Jul 02, 2026 at 04:47:39PM -0700, Deborah Brouwer wrote:
> Currently, using a raw IoPageTable is unsafe because the returned
> IoPageTable is not tied to the device driver binding lifetime.
> 
> Since device drivers now receive a lifetime parameter <'bound>
> representing the interval during which a device driver is bound to its bus
> device, add this lifetime parameter to IoPageTable. This ensures that
> the returned IoPageTable cannot outlive the bus device binding.
> 
> Also temporarily remove the option to create a page table as a device
> resource since currently Devres is not compatible with resources that have
> a lifetime parameter. This option can be restored once the lifetime-aware
> wrapper for devres is available.
> 
> Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
> Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
> ---
>  rust/kernel/iommu/pgtable.rs | 32 ++++++++++----------------------
>  1 file changed, 10 insertions(+), 22 deletions(-)
> 
> diff --git a/rust/kernel/iommu/pgtable.rs b/rust/kernel/iommu/pgtable.rs
> index c88e38fd938a..d4a16283b5a7 100644
> --- a/rust/kernel/iommu/pgtable.rs
> +++ b/rust/kernel/iommu/pgtable.rs
> @@ -16,7 +16,6 @@
>          Bound,
>          Device, //
>      },
> -    devres::Devres,
>      error::to_result,
>      io::PhysAddr,
>      prelude::*, //
> @@ -59,15 +58,16 @@ pub struct Config {
>  /// # Invariants
>  ///
>  /// The pointer references a valid io page table.
> -pub struct IoPageTable<F: IoPageTableFmt> {
> +pub struct IoPageTable<'bound, F: IoPageTableFmt> {
>      ptr: NonNull<bindings::io_pgtable_ops>,
> +    _dev: PhantomData<&'bound Device<Bound>>,
>      _marker: PhantomData<F>,
>  }
>  
>  // SAFETY: `struct io_pgtable_ops` is not restricted to a single thread.
> -unsafe impl<F: IoPageTableFmt> Send for IoPageTable<F> {}
> +unsafe impl<F: IoPageTableFmt> Send for IoPageTable<'_, F> {}
>  // SAFETY: `struct io_pgtable_ops` may be accessed concurrently.
> -unsafe impl<F: IoPageTableFmt> Sync for IoPageTable<F> {}
> +unsafe impl<F: IoPageTableFmt> Sync for IoPageTable<'_, F> {}
>  
>  /// The format used by this page table.
>  pub trait IoPageTableFmt: 'static {
> @@ -75,25 +75,12 @@ pub trait IoPageTableFmt: 'static {
>      const FORMAT: io_pgtable_fmt;
>  }
>  
> -impl<F: IoPageTableFmt> IoPageTable<F> {
> -    /// Create a new `IoPageTable` as a device resource.
> -    #[inline]
> -    pub fn new(
> -        dev: &Device<Bound>,
> -        config: Config,
> -    ) -> impl PinInit<Devres<IoPageTable<F>>, Error> + '_ {
> -        // SAFETY: Devres ensures that the value is dropped during device unbind.
> -        Devres::new(dev, unsafe { Self::new_raw(dev, config) })
> -    }
> +impl<'bound, F: IoPageTableFmt> IoPageTable<'bound, F> {
> +    // TODO: Create a new `IoPageTable` as a device resource when DevresLt is available.
>  
>      /// Create a new `IoPageTable`.
> -    ///
> -    /// # Safety
> -    ///
> -    /// If successful, then the returned `IoPageTable` must be dropped before the device is
> -    /// unbound.
>      #[inline]
> -    pub unsafe fn new_raw(dev: &Device<Bound>, config: Config) -> Result<IoPageTable<F>> {
> +    pub fn new_raw(dev: &'bound Device<Bound>, config: Config) -> Result<IoPageTable<'bound, F>> {

The name new_raw() indicates that this is something you only use in rare
cases when you are doing weird stuff. But with this change, I no longer
think that's the case.

I would suggest renaming this method to just `new()`.

As for creating a device resoure version with DevresLt, I think that can
be the secondary constructor and be called `new_devres()` or similar.

Otherwise LGTM.

Alice

Re: [PATCH] rust: iommu: add device lifetime to IoPageTable

[Danilo Krummrich]

On Fri Jul 3, 2026 at 8:44 AM CEST, Alice Ryhl wrote:
> I would suggest renaming this method to just `new()`.

Agreed.

> As for creating a device resoure version with DevresLt, I think that can
> be the secondary constructor and be called `new_devres()` or similar.

Other device resources use an into_devres() method consuming self. However, I
wouldn't add it until we have a valid use-case anyway.