Re: [PATCH v2 03/12] rust: pci: allow drivers to manage DMA ownership

[Danilo Krummrich]

On Fri Oct 23, 2026 at 5:39 PM CEST, Simon Song wrote:
> diff --git a/rust/kernel/pci.rs b/rust/kernel/pci.rs
> index 10864ffda4e..a156927e23d 100644
> --- a/rust/kernel/pci.rs
> +++ b/rust/kernel/pci.rs
> @@ -108,6 +108,7 @@ unsafe fn register(
>              (*pdrv.get()).probe = Some(Self::probe_callback);
>              (*pdrv.get()).remove = Some(Self::remove_callback);
>              (*pdrv.get()).id_table = T::ID_TABLE.as_ptr();
> +            (*pdrv.get()).driver_managed_dma = T::DRIVER_MANAGED_DMA;
>              #[cfg(CONFIG_PCI_IOV)]
>              if T::HAS_SRIOV_ENABLE {
>                  (*pdrv.get()).sriov_configure = Some(Self::sriov_configure_callback);
> @@ -345,6 +346,9 @@ pub trait Driver {
>      /// The table of device ids supported by the driver.
>      const ID_TABLE: IdTable<Self::IdInfo>;
>  
> +    /// Whether the driver manages DMA ownership instead of using the default DMA domain.
> +    const DRIVER_MANAGED_DMA: bool = false;

The problem with this is that it doesn't prevent drivers from calling into the
safe dma::* APIs and hence is unsound (the IOMMU core relies on this contract
AFAIK).

This completely goes away once we implement the InitTokens and dma::Setup token
idea [1] from Alex and me.

I.e. you'd have something like this passed to probe():

	#[non_exhaustive]
	pub struct InitTokens<'bound> {
	    /// None when the driver manages DMA ownership.
	    pub dma: Option<dma::Setup<'bound>>,
	}

In order to not make this a blocker for this series, we could also do something
like this in the meantime:

	pub struct DriverManagedDma<D: ?Sized>(
	    PhantomData<fn() -> *mut D>,
	);
	
	impl<D: ?Sized> DriverManagedDma<D> {
	    /// # Safety
	    ///
	    /// The caller must ensure that devices bound to `D` are not used
	    /// for DMA allocations or mappings through the kernel DMA API,
	    /// directly or through helpers.
	    pub const unsafe fn new() -> Self {
	        Self(PhantomData)
	    }
	}
	
	pub trait Driver {
	    const DRIVER_MANAGED_DMA: Option<DriverManagedDma<Self>> = None;
	}
	
	impl pci::Driver for MyDriver {
	    // SAFETY: This driver never uses the kernel DMA API for its devices,
	    // directly or through helpers.
	    const DRIVER_MANAGED_DMA: Option<pci::DriverManagedDma<Self>> =
	        Some(unsafe { pci::DriverManagedDma::new() });
	}

[1] https://lore.kernel.org/all/DLUTSDP614AJ.2JU6SDKECJOCU@xxxxxxxxxx/