[PATCH v2] rust: iommu: add device lifetime to IoPageTable

[PATCH v2] rust: iommu: add device lifetime to IoPageTable

[Deborah Brouwer]

Currently, using a raw IoPageTable is unsafe because the returned
IoPageTable is not tied to the device driver binding lifetime.

Since device drivers now receive a lifetime parameter <'bound>
representing the interval during which a device driver is bound to its bus
device, add this lifetime parameter to IoPageTable. This ensures that
the returned IoPageTable cannot outlive the bus device binding.

Also temporarily remove the option to create a page table as a device
resource since currently Devres is not compatible with resources that have
a lifetime parameter. This option can be restored once the lifetime-aware
wrapper for devres is available.

Suggested-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Deborah Brouwer <deborah.brouwer@collabora.com>
---
Changes in v2:
- Renamed new_raw() to new(), since the constructor is now safe.

Link to v1:
https://lore.kernel.org/rust-for-linux/20260702-pgtable_lt_v1-v1-1-18d9c9812a1a@collabora.com/
---
 rust/kernel/iommu/pgtable.rs | 33 +++++++++++----------------------
 1 file changed, 11 insertions(+), 22 deletions(-)

diff --git a/rust/kernel/iommu/pgtable.rs b/rust/kernel/iommu/pgtable.rs
index c88e38fd938a..48bfb72eead6 100644
--- a/rust/kernel/iommu/pgtable.rs
+++ b/rust/kernel/iommu/pgtable.rs
@@ -16,7 +16,6 @@
         Bound,
         Device, //
     },
-    devres::Devres,
     error::to_result,
     io::PhysAddr,
     prelude::*, //
@@ -59,15 +58,16 @@ pub struct Config {
 /// # Invariants
 ///
 /// The pointer references a valid io page table.
-pub struct IoPageTable<F: IoPageTableFmt> {
+pub struct IoPageTable<'bound, F: IoPageTableFmt> {
     ptr: NonNull<bindings::io_pgtable_ops>,
+    _dev: PhantomData<&'bound Device<Bound>>,
     _marker: PhantomData<F>,
 }
 
 // SAFETY: `struct io_pgtable_ops` is not restricted to a single thread.
-unsafe impl<F: IoPageTableFmt> Send for IoPageTable<F> {}
+unsafe impl<F: IoPageTableFmt> Send for IoPageTable<'_, F> {}
 // SAFETY: `struct io_pgtable_ops` may be accessed concurrently.
-unsafe impl<F: IoPageTableFmt> Sync for IoPageTable<F> {}
+unsafe impl<F: IoPageTableFmt> Sync for IoPageTable<'_, F> {}
 
 /// The format used by this page table.
 pub trait IoPageTableFmt: 'static {
@@ -75,25 +75,13 @@ pub trait IoPageTableFmt: 'static {
     const FORMAT: io_pgtable_fmt;
 }
 
-impl<F: IoPageTableFmt> IoPageTable<F> {
-    /// Create a new `IoPageTable` as a device resource.
-    #[inline]
-    pub fn new(
-        dev: &Device<Bound>,
-        config: Config,
-    ) -> impl PinInit<Devres<IoPageTable<F>>, Error> + '_ {
-        // SAFETY: Devres ensures that the value is dropped during device unbind.
-        Devres::new(dev, unsafe { Self::new_raw(dev, config) })
-    }
+impl<'bound, F: IoPageTableFmt> IoPageTable<'bound, F> {
+    // TODO: Provide the option to return `IoPageTable` as a device resource
+    // when DevresLt is available.
 
     /// Create a new `IoPageTable`.
-    ///
-    /// # Safety
-    ///
-    /// If successful, then the returned `IoPageTable` must be dropped before the device is
-    /// unbound.
     #[inline]
-    pub unsafe fn new_raw(dev: &Device<Bound>, config: Config) -> Result<IoPageTable<F>> {
+    pub fn new(dev: &'bound Device<Bound>, config: Config) -> Result<IoPageTable<'bound, F>> {
         let mut raw_cfg = bindings::io_pgtable_cfg {
             quirks: config.quirks,
             pgsize_bitmap: config.pgsize_bitmap,
@@ -118,6 +106,7 @@ pub unsafe fn new_raw(dev: &Device<Bound>, config: Config) -> Result<IoPageTable
         // INVARIANT: We successfully created a valid page table.
         Ok(IoPageTable {
             ptr: NonNull::new(ops).ok_or(ENOMEM)?,
+            _dev: PhantomData,
             _marker: PhantomData,
         })
     }
@@ -240,7 +229,7 @@ extern "C" fn rust_tlb_flush_walk_noop(
 ) {
 }
 
-impl<F: IoPageTableFmt> Drop for IoPageTable<F> {
+impl<F: IoPageTableFmt> Drop for IoPageTable<'_, F> {
     fn drop(&mut self) {
         // SAFETY: The caller of `Self::ttbr()` promised that the page table is not live when this
         // destructor runs.
@@ -255,7 +244,7 @@ impl IoPageTableFmt for ARM64LPAES1 {
     const FORMAT: io_pgtable_fmt = bindings::io_pgtable_fmt_ARM_64_LPAE_S1 as io_pgtable_fmt;
 }
 
-impl IoPageTable<ARM64LPAES1> {
+impl IoPageTable<'_, ARM64LPAES1> {
     /// Access the `ttbr` field of the configuration.
     ///
     /// This is the physical address of the page table, which may be passed to the device that

---
base-commit: dd8a3c6cd531dca5917111a94fa3074077f6ba5a
change-id: 20260703-pgtable_lt_b4-72db24dad3af

Best regards,
-- 
Deborah Brouwer <deborah.brouwer@collabora.com>

Re: [PATCH v2] rust: iommu: add device lifetime to IoPageTable

[Danilo Krummrich]

On Fri Jul 3, 2026 at 8:52 PM CEST, Deborah Brouwer wrote:
> +impl<'bound, F: IoPageTableFmt> IoPageTable<'bound, F> {

We settled on the convention to only call a lifetime 'bound when it actually
described the entire bound scope. This might be shorter lived, so maybe just 'a.

> +    // TODO: Provide the option to return `IoPageTable` as a device resource
> +    // when DevresLt is available.

I'd drop this comment, we only really need it once there's a justified use-case,
or do you have something in mind already?

Re: [PATCH v2] rust: iommu: add device lifetime to IoPageTable

[Deborah Brouwer]

On Fri, Jul 03, 2026 at 09:37:53PM +0200, Danilo Krummrich wrote:
> On Fri Jul 3, 2026 at 8:52 PM CEST, Deborah Brouwer wrote:
> > +impl<'bound, F: IoPageTableFmt> IoPageTable<'bound, F> {
> 
> We settled on the convention to only call a lifetime 'bound when it actually
> described the entire bound scope. This might be shorter lived, so maybe just 'a.

Ack.

> 
> > +    // TODO: Provide the option to return `IoPageTable` as a device resource
> > +    // when DevresLt is available.
> 
> I'd drop this comment, we only really need it once there's a justified use-case,
> or do you have something in mind already?

Sure, I will drop the comment. I don't have a particular use case in mind.
Tyr will own the page table through its VM data, so with the lifetime tied
to the bound device there is no need for Tyr to use devres.