rust: drm: Higher-Ranked Lifetime private data

Add a ParentDevice associated type to the Driver trait, allowing each DRM driver to declare its parent bus device type (e.g. auxiliary::Device, platform::Device).

Change UnregisteredDevice::new() to take &T::ParentDevice<Bound>, ensuring at the type level that the DRM device's parent matches the declared bus device type.

Signed-off-by Danilo Krummrich <[email protected]>

---
 drivers/gpu/drm/nova/driver.rs | 8 ++++++--
 drivers/gpu/drm/tyr/driver.rs  | 6 ++++--
 rust/kernel/drm/device.rs      | 7 +++++--
 rust/kernel/drm/driver.rs      | 3 +++

 4 files changed, 18 insertions(+), 6 deletions(-)

drivers/gpu/drm/nova/driver.rs +0 -0

index 9eef28b506bb..9d4100f01ea7 100644
@@ -2,7 +2,10 @@

 use kernel::{
     auxiliary,
-    device::Core,
+    device::{
+        Core,
+        DeviceContext, //
+    },
     drm::{
         self,
         gem,

drivers/gpu/drm/nova/driver.rs +0 -0

@@ -59,7 +62,7 @@ fn probe(
      ) -> impl PinInit<Self, Error> + 'bound {
          let data = try_pin_init!(NovaData { adev: adev.into() });

-        let drm = drm::UnregisteredDevice::<Self>::new(adev.as_ref(), data)?; +        let drm = drm::UnregisteredDevice::<Self>::new(adev, data)?; let drm = drm::Registration::new_foreign_owned(drm, adev.as_ref(), 0)?;

         Ok(Self { drm: drm.into() })

drivers/gpu/drm/nova/driver.rs +1 -0

@@ -71,6 +74,7 @@ impl drm::Driver for NovaDriver {
      type Data = NovaData;
      type File = File;
      type Object<Ctx: drm::DeviceContext> = gem::Object<NovaObject,
 Ctx>;
+    type ParentDevice<Ctx: DeviceContext> = auxiliary::Device<Ctx>;

     const INFO: drm::DriverInfo = INFO;

drivers/gpu/drm/tyr/driver.rs +2 -1

index 2743178af325..747745d23f31 100644
@@ -8,7 +8,8 @@
      device::{
          Bound,
          Core,
-        Device, //
+        Device,
+        DeviceContext, //
      },
      drm,
      drm::ioctl,

@@ -131,7 +132,7 @@ fn probe(
                  gpu_info,
          });

-        let tdev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev.as_ref(), data)?; +        let tdev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?; let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), 0)?;

         let driver = TyrPlatformDriverData {

drivers/gpu/drm/tyr/driver.rs +1 -0

@@ -176,6 +177,7 @@ impl drm::Driver for TyrDrmDriver {
      type Data = TyrDrmDeviceData;
      type File = TyrDrmFileData;
      type Object<R: drm::DeviceContext> = drm::gem::Object<TyrObject,
 R>;
+    type ParentDevice<Ctx: DeviceContext> = platform::Device<Ctx>;

     const INFO: drm::DriverInfo = INFO;

rust/kernel/drm/device.rs +0 -0

index d91f19dcc375..492c2f2c7ca4 100644
@@ -197,7 +197,10 @@ impl<T: drm::Driver> UnregisteredDevice<T> {
      /// Create a new `UnregisteredDevice` for a `drm::Driver`.
      ///
      /// This can be used to create a

[Registration](kernel::drm::Registration).
-    pub fn new(dev: &device::Device, data: impl PinInit<T::Data, Error>) -> Result<Self> {
+    pub fn new(
+        dev: &T::ParentDevice<device::Bound>,
+        data: impl PinInit<T::Data, Error>,
+    ) -> Result<Self> {
         // __drm_dev_alloc uses kmalloc() to allocate memory, hence ensure a kmalloc()
         // compatible Layout.
         let layout = Kmalloc::aligned_layout(Layout::new::<Device<T, Uninit>>());

rust/kernel/drm/device.rs +0 -0

@@ -207,7 +210,7 @@ pub fn new(dev: &device::Device, data: impl

PinInit<T::Data, Error>) -> Result<S
         // - dev is valid by its type invarants, let raw_drm: *mut Device<T, Uninit> = unsafe { bindings::__drm_dev_alloc(
-                dev.as_raw(),
+                dev.as_ref().as_raw(), &Self::VTABLE,
                 layout.size(), mem::offset_of!(Device<T, Uninit>, dev),

rust/kernel/drm/driver.rs +0 -0

index 294e17af86a3..9d06f8c5b2da 100644
@@ -114,6 +114,9 @@ pub trait Driver {
      /// The type used to represent a DRM File (client)
      type File: drm::file::DriverFile;

+    /// The bus device type of the parent device that the DRM device is associated with.
+    type ParentDevice<Ctx: device::DeviceContext>:
device::AsBusDevice<Ctx>;
+
     /// Driver metadata
     const INFO: DriverInfo;

DRM ioctls do not guarantee that the parent bus device is still bound. However, since DRM device registration is managed through Devres, using drm_dev_unplug() on unregistration ensures that between drm_dev_enter() and drm_dev_exit() the parent device must be bound.

Add UnbindGuard, a guard object representing a drm_dev_enter/exit SRCU critical section that dereferences to &Device<Bound> of the parent bus device. The guard is only available on Device<T, Registered>, ensuring it cannot be used on unregistered devices.

Also add with_unbind_guard() as a convenience helper that executes a closure with the bound device reference.

Switch Registration::drop from drm_dev_unregister() to drm_dev_unplug() to provide the SRCU barrier that UnbindGuard's safety argument relies on.

Signed-off-by Danilo Krummrich <[email protected]>

---
 rust/kernel/drm/device.rs | 80 ++++++++++++++++++++++++++++++++++++++-
 rust/kernel/drm/driver.rs | 10 ++++-
 2 files changed, 87 insertions(+), 3 deletions(-)

rust/kernel/drm/device.rs +79 -1

index 492c2f2c7ca4..bb685165032d 100644
@@ -6,7 +6,11 @@
 
 use crate::{
     alloc::allocator::Kmalloc,
-    bindings, device,
+    bindings,
+    device::{
+        self,
+        AsBusDevice as _, //
+    },
     drm::{
         self,
         driver::AllocImpl,

@@ -334,6 +338,80 @@ pub(crate) unsafe fn assume_ctx<NewCtx: DeviceContext>(&self) -> &Device<T, NewC
     }
 }
 
+impl<T: drm::Driver> Device<T, Registered> {
+    /// Guard against the parent bus device being unbound.
+    ///
+    /// Returns an [`UnbindGuard`] if the device has not been unplugged, [`None`] otherwise.
+    ///
+    /// The returned guard dereferences to the parent bus device in the [`device::Bound`] context
+    /// (see [`Driver::ParentDevice`](drm::Driver::ParentDevice)).
+    /// Between `drm_dev_enter()` and `drm_dev_exit()` the parent device is guaranteed to be bound.
+    #[must_use]
+    pub fn unbind_guard(&self) -> Option<UnbindGuard<'_, T>> {
+        let mut idx: i32 = 0;
+        // SAFETY: `self.as_raw()` is a valid pointer to a `struct drm_device` by the type
+        // invariants of `Device<T, Registered>`.
+        if unsafe { bindings::drm_dev_enter(self.as_raw(), &mut idx) } {
+            Some(UnbindGuard { dev: self, idx })
+        } else {
+            None
+        }
+    }
+
+    /// Execute a closure while the parent bus device is guaranteed to be bound.
+    ///
+    /// Acquires the [`UnbindGuard`] and, if the device has not been unplugged, calls `f` with the
+    /// parent bus device. Returns `None` if the device has been unplugged.
+    pub fn with_unbind_guard<R>(
+        &self,
+        f: impl FnOnce(&T::ParentDevice<device::Bound>) -> R,
+    ) -> Option<R> {
+        let guard = self.unbind_guard()?;
+        Some(f(&guard))
+    }
+}
+
+/// A guard preventing the parent bus device from being unbound.
+///
+/// The guard dereferences to [`Driver::ParentDevice<Bound>`](drm::Driver::ParentDevice), providing
+/// access to the parent bus device with the guarantee that it is bound for the entire duration of
+/// the critical section.
+///
+/// Internally this is backed by a `drm_dev_enter()` / `drm_dev_exit()` SRCU critical section.
+///
+/// See [`Device::unbind_guard`] for details on the safety argument.
+///
+/// # Invariants
+///
+/// - `idx` is the SRCU read lock index returned by a successful `drm_dev_enter()` call.
+/// - The parent bus device of `dev` is bound for the lifetime of this guard.
+#[must_use]
+pub struct UnbindGuard<'a, T: drm::Driver> {
+    dev: &'a Device<T, Registered>,
+    idx: i32,
+}
+
+impl<T: drm::Driver> Deref for UnbindGuard<'_, T> {
+    type Target = T::ParentDevice<device::Bound>;
+
+    fn deref(&self) -> &Self::Target {
+        // SAFETY:
+        // - The parent `struct device` is embedded in a `T::ParentDevice`, as guaranteed by
+        //   `UnregisteredDevice::new` taking a `&T::ParentDevice<device::Bound>`.
+        // - By the type invariants of `UnbindGuard`, the parent device is bound for the lifetime
+        //   of this guard.
+        unsafe { T::ParentDevice::from_device(self.dev.as_ref().as_bound()) }
+    }
+}
+
+impl<T: drm::Driver> Drop for UnbindGuard<'_, T> {
+    fn drop(&mut self) {
+        // SAFETY: `self.idx` was returned by a successful `drm_dev_enter()` call, as guaranteed
+        // by the type invariants of `UnbindGuard`.
+        unsafe { bindings::drm_dev_exit(self.idx) };
+    }
+}
+
 impl<T: drm::Driver, C: DeviceContext> Deref for Device<T, C> {
     type Target = T::Data;
 

rust/kernel/drm/driver.rs +8 -2

index 9d06f8c5b2da..751a68bb27e1 100644
@@ -187,8 +187,14 @@ unsafe impl<T: Driver> Send for Registration<T> {}
 
 impl<T: Driver> Drop for Registration<T> {
     fn drop(&mut self) {
+        // Use `drm_dev_unplug` rather than `drm_dev_unregister` to ensure that existing
+        // `drm_dev_enter()` critical sections complete before unregistration proceeds. This
+        // is required for the safety of `UnbindGuard`, which relies on the SRCU barrier in
+        // `drm_dev_unplug()` to guarantee that the parent device is still bound within the
+        // critical section.
+        //
         // SAFETY: Safe by the invariant of `ARef<drm::Device<T>>`. The existence of this
-        // `Registration` also guarantees the this `drm::Device` is actually registered.
-        unsafe { bindings::drm_dev_unregister(self.0.as_raw()) };
+        // `Registration` also guarantees that this `drm::Device` is actually registered.
+        unsafe { bindings::drm_dev_unplug(self.0.as_raw()) };
     }
 }

Signature · 1 line

2.54.0

On 2026-05-07 at 08:06 +1000, Danilo Krummrich <[email protected]> wrote...

Quoted 10 lines

DRM ioctls do not guarantee that the parent bus device is still bound. However, since DRM device registration is managed through Devres, using drm_dev_unplug() on unregistration ensures that between drm_dev_enter() and drm_dev_exit() the parent device must be bound.

Add UnbindGuard, a guard object representing a drm_dev_enter/exit SRCU critical section that dereferences to &Device<Bound> of the parent bus device. The guard is only available on Device<T, Registered>, ensuring it cannot be used on unregistered devices.

Quoted 5 lines

Also add with_unbind_guard() as a convenience helper that executes a closure with the bound device reference.

Switch Registration::drop from drm_dev_unregister() to drm_dev_unplug() to provide the SRCU barrier that UnbindGuard's safety argument relies on.

I don't (yet) claim to be a Rust-for-Linux expert but reading through this made sense to me and it's been useful for some Nova development so feel free to add:

Reviewed-by Alistair Popple <[email protected]>

for whatever that is worth :-)

Quoted 128 lines

Signed-off-by Danilo Krummrich <[email protected]>

---
 rust/kernel/drm/device.rs | 80 ++++++++++++++++++++++++++++++++++++++-
 rust/kernel/drm/driver.rs | 10 ++++-
 2 files changed, 87 insertions(+), 3 deletions(-)

rust/kernel/drm/device.rs +79 -1

index 492c2f2c7ca4..bb685165032d 100644
@@ -6,7 +6,11 @@
 
 use crate::{
     alloc::allocator::Kmalloc,
-    bindings, device,
+    bindings,
+    device::{
+        self,
+        AsBusDevice as _, //
+    },
     drm::{
         self,
         driver::AllocImpl,

@@ -334,6 +338,80 @@ pub(crate) unsafe fn assume_ctx<NewCtx: DeviceContext>(&self) -> &Device<T, NewC
     }
 }
 
+impl<T: drm::Driver> Device<T, Registered> {
+    /// Guard against the parent bus device being unbound.
+    ///
+    /// Returns an [`UnbindGuard`] if the device has not been unplugged, [`None`] otherwise.
+    ///
+    /// The returned guard dereferences to the parent bus device in the [`device::Bound`] context
+    /// (see [`Driver::ParentDevice`](drm::Driver::ParentDevice)).
+    /// Between `drm_dev_enter()` and `drm_dev_exit()` the parent device is guaranteed to be bound.
+    #[must_use]
+    pub fn unbind_guard(&self) -> Option<UnbindGuard<'_, T>> {
+        let mut idx: i32 = 0;
+        // SAFETY: `self.as_raw()` is a valid pointer to a `struct drm_device` by the type
+        // invariants of `Device<T, Registered>`.
+        if unsafe { bindings::drm_dev_enter(self.as_raw(), &mut idx) } {
+            Some(UnbindGuard { dev: self, idx })
+        } else {
+            None
+        }
+    }
+
+    /// Execute a closure while the parent bus device is guaranteed to be bound.
+    ///
+    /// Acquires the [`UnbindGuard`] and, if the device has not been unplugged, calls `f` with the
+    /// parent bus device. Returns `None` if the device has been unplugged.
+    pub fn with_unbind_guard<R>(
+        &self,
+        f: impl FnOnce(&T::ParentDevice<device::Bound>) -> R,
+    ) -> Option<R> {
+        let guard = self.unbind_guard()?;
+        Some(f(&guard))
+    }
+}
+
+/// A guard preventing the parent bus device from being unbound.
+///
+/// The guard dereferences to [`Driver::ParentDevice<Bound>`](drm::Driver::ParentDevice), providing
+/// access to the parent bus device with the guarantee that it is bound for the entire duration of
+/// the critical section.
+///
+/// Internally this is backed by a `drm_dev_enter()` / `drm_dev_exit()` SRCU critical section.
+///
+/// See [`Device::unbind_guard`] for details on the safety argument.
+///
+/// # Invariants
+///
+/// - `idx` is the SRCU read lock index returned by a successful `drm_dev_enter()` call.
+/// - The parent bus device of `dev` is bound for the lifetime of this guard.
+#[must_use]
+pub struct UnbindGuard<'a, T: drm::Driver> {
+    dev: &'a Device<T, Registered>,
+    idx: i32,
+}
+
+impl<T: drm::Driver> Deref for UnbindGuard<'_, T> {
+    type Target = T::ParentDevice<device::Bound>;
+
+    fn deref(&self) -> &Self::Target {
+        // SAFETY:
+        // - The parent `struct device` is embedded in a `T::ParentDevice`, as guaranteed by
+        //   `UnregisteredDevice::new` taking a `&T::ParentDevice<device::Bound>`.
+        // - By the type invariants of `UnbindGuard`, the parent device is bound for the lifetime
+        //   of this guard.
+        unsafe { T::ParentDevice::from_device(self.dev.as_ref().as_bound()) }
+    }
+}
+
+impl<T: drm::Driver> Drop for UnbindGuard<'_, T> {
+    fn drop(&mut self) {
+        // SAFETY: `self.idx` was returned by a successful `drm_dev_enter()` call, as guaranteed
+        // by the type invariants of `UnbindGuard`.
+        unsafe { bindings::drm_dev_exit(self.idx) };
+    }
+}
+
 impl<T: drm::Driver, C: DeviceContext> Deref for Device<T, C> {
     type Target = T::Data;
 

rust/kernel/drm/driver.rs +8 -2

index 9d06f8c5b2da..751a68bb27e1 100644
@@ -187,8 +187,14 @@ unsafe impl<T: Driver> Send for Registration<T> {}
 
 impl<T: Driver> Drop for Registration<T> {
     fn drop(&mut self) {
+        // Use `drm_dev_unplug` rather than `drm_dev_unregister` to ensure that existing
+        // `drm_dev_enter()` critical sections complete before unregistration proceeds. This
+        // is required for the safety of `UnbindGuard`, which relies on the SRCU barrier in
+        // `drm_dev_unplug()` to guarantee that the parent device is still bound within the
+        // critical section.
+        //
         // SAFETY: Safe by the invariant of `ARef<drm::Device<T>>`. The existence of this
-        // `Registration` also guarantees the this `drm::Device` is actually registered.
-        unsafe { bindings::drm_dev_unregister(self.0.as_raw()) };
+        // `Registration` also guarantees that this `drm::Device` is actually registered.
+        unsafe { bindings::drm_dev_unplug(self.0.as_raw()) };
     }
 }

Signature · 1 line

2.54.0

On 2026-05-26 at 16:17 +1000, Alistair Popple <[email protected]> wrote...

Quoted 20 lines

On 2026-05-07 at 08:06 +1000, Danilo Krummrich <[email protected]> wrote...

Quoted 10 lines

DRM ioctls do not guarantee that the parent bus device is still bound. However, since DRM device registration is managed through Devres, using drm_dev_unplug() on unregistration ensures that between drm_dev_enter() and drm_dev_exit() the parent device must be bound.

Add UnbindGuard, a guard object representing a drm_dev_enter/exit SRCU critical section that dereferences to &Device<Bound> of the parent bus device. The guard is only available on Device<T, Registered>, ensuring it cannot be used on unregistered devices.

Quoted 5 lines

Also add with_unbind_guard() as a convenience helper that executes a closure with the bound device reference.

Switch Registration::drop from drm_dev_unregister() to drm_dev_unplug() to provide the SRCU barrier that UnbindGuard's safety argument relies on.

I don't (yet) claim to be a Rust-for-Linux expert but reading through this made sense to me and it's been useful for some Nova development so feel free to add:

Quoted 3 lines

Reviewed-by Alistair Popple <[email protected]>

for whatever that is worth :-)

Which is definitely not much :) I just realised this has been replaced by a more recent version of this series with 24 patches, so will use that instead.

DRM ioctls do not guarantee that the parent bus device is still bound. However, since DRM device registration is managed through Devres, using drm_dev_unplug() on unregistration ensures that between drm_dev_enter() and drm_dev_exit() the parent device must be bound.

Add UnbindGuard, a guard object representing a drm_dev_enter/exit SRCU critical section that dereferences to &Device<Bound> of the parent bus device. The guard is only available on Device<T, Registered>, ensuring it cannot be used on unregistered devices.

Also add with_unbind_guard() as a convenience helper that executes a closure with the bound device reference.

Switch Registration::drop from drm_dev_unregister() to drm_dev_unplug() to provide the SRCU barrier that UnbindGuard's safety argument relies on.

Signed-off-by Danilo Krummrich <[email protected]>

---
 rust/kernel/drm/device.rs | 80 ++++++++++++++++++++++++++++++++++++++-
 rust/kernel/drm/driver.rs | 10 ++++-
 2 files changed, 87 insertions(+), 3 deletions(-)

rust/kernel/drm/device.rs +5 -1

index 492c2f2c7ca4..bb685165032d 100644
@@ -6,7 +6,11 @@
 
 use crate::{
     alloc::allocator::Kmalloc,
-    bindings, device,
+    bindings,
+    device::{
+        self,
+        AsBusDevice as _, //
+    },
     drm::{
         self,
         driver::AllocImpl,

@@ -334,6 +338,80 @@ pub(crate) unsafe fn assume_ctx<NewCtx: DeviceContext>(&self) -> &Device<T, NewC
     }

rust/kernel/drm/device.rs +36 -0

+        let mut idx: i32 = 0;
+        // SAFETY: `self.as_raw()` is a valid pointer to a `struct drm_device` by the type
+        // invariants of `Device<T, Registered>`.
+        if unsafe { bindings::drm_dev_enter(self.as_raw(), &mut idx) } {
+            Some(UnbindGuard { dev: self, idx })
+        } else {
+            None
+        }
+    }
+
+    /// Execute a closure while the parent bus device is guaranteed to be bound.
+    ///
+    /// Acquires the [`UnbindGuard`] and, if the device has not been unplugged, calls `f` with the
+    /// parent bus device. Returns `None` if the device has been unplugged.
+    pub fn with_unbind_guard<R>(
+        &self,
+        f: impl FnOnce(&T::ParentDevice<device::Bound>) -> R,
+    ) -> Option<R> {
+        let guard = self.unbind_guard()?;
+        Some(f(&guard))
+    }
+}
+
+/// A guard preventing the parent bus device from being unbound.
+///
+/// The guard dereferences to [`Driver::ParentDevice<Bound>`](drm::Driver::ParentDevice), providing
+/// access to the parent bus device with the guarantee that it is bound for the entire duration of
+/// the critical section.
+///
+/// Internally this is backed by a `drm_dev_enter()` / `drm_dev_exit()` SRCU critical section.
+///
+/// See [`Device::unbind_guard`] for details on the safety argument.
+///
+/// # Invariants
+///
+/// - `idx` is the SRCU read lock index returned by a successful `drm_dev_enter()` call.

rust/kernel/drm/device.rs +7 -0

+    fn drop(&mut self) {
+        // SAFETY: `self.idx` was returned by a successful `drm_dev_enter()` call, as guaranteed
+        // by the type invariants of `UnbindGuard`.
+        unsafe { bindings::drm_dev_exit(self.idx) };
+    }
+}
+
 impl<T: drm::Driver, C: DeviceContext> Deref for Device<T, C> {
     type Target = T::Data;
 

rust/kernel/drm/driver.rs +8 -2

index 9d06f8c5b2da..751a68bb27e1 100644
@@ -187,8 +187,14 @@ unsafe impl<T: Driver> Send for Registration<T> {}
 
 impl<T: Driver> Drop for Registration<T> {
     fn drop(&mut self) {
+        // Use `drm_dev_unplug` rather than `drm_dev_unregister` to ensure that existing
+        // `drm_dev_enter()` critical sections complete before unregistration proceeds. This
+        // is required for the safety of `UnbindGuard`, which relies on the SRCU barrier in
+        // `drm_dev_unplug()` to guarantee that the parent device is still bound within the
+        // critical section.
+        //
         // SAFETY: Safe by the invariant of `ARef<drm::Device<T>>`. The existence of this
-        // `Registration` also guarantees the this `drm::Device` is actually registered.
-        unsafe { bindings::drm_dev_unregister(self.0.as_raw()) };
+        // `Registration` also guarantees that this `drm::Device` is actually registered.
+        unsafe { bindings::drm_dev_unplug(self.0.as_raw()) };
     }
 }

Add a RegistrationData associated type to drm::Driver. This is a ForLt
type whose lifetime is tied to the parent bus device binding scope.

Registration<T> takes ownership of the data via Pin<KBox<_>>, erasing the lifetime to 'static for storage. The pointer is written to drm::Device before drm_dev_register() to ensure it is already in place
when ioctls arrive.

UnbindGuard::registration_data() provides access with the lifetime shortened from 'static via ForLt::cast_ref. Since Registration::drop()
calls drm_dev_unplug() -- which performs an SRCU barrier waiting for all
drm_dev_enter() critical sections to complete -- the data is guaranteed
to remain valid for the duration of any UnbindGuard.

Signed-off-by Danilo Krummrich <[email protected]>

---
 drivers/gpu/drm/nova/driver.rs |  6 ++- drivers/gpu/drm/tyr/driver.rs  |  6 ++- rust/kernel/drm/device.rs      | 40 +++++++++++++++ rust/kernel/drm/driver.rs      | 89 +++++++++++++++++++++++++++----- --
 rust/kernel/drm/mod.rs         |  1 +

 5 files changed, 121 insertions(+), 21 deletions(-)

drivers/gpu/drm/nova/driver.rs +0 -0

index 9d4100f01ea7..54a3391371ba 100644
@@ -12,7 +12,8 @@

         ioctl, //
     },
     prelude::*,
-    sync::aref::ARef, //
+    sync::aref::ARef,
+    types::ForLt, //
 };

 use crate::file::File;

drivers/gpu/drm/nova/driver.rs +0 -0

@@ -63,7 +64,7 @@ fn probe(
          let data = try_pin_init!(NovaData { adev: adev.into() });

         let drm = drm::UnregisteredDevice::<Self>::new(adev, data)?; -        let drm = drm::Registration::new_foreign_owned(drm, adev.as_ref(), 0)?;
+        let drm = drm::Registration::new_foreign_owned(drm, adev.as_ref(), (), 0)?;

         Ok(Self { drm: drm.into() })
     }

drivers/gpu/drm/nova/driver.rs +1 -0

@@ -72,6 +73,7 @@ fn probe(
  #[vtable]
  impl drm::Driver for NovaDriver {
      type Data = NovaData;
+    type RegistrationData = ForLt!(());
      type File = File;
      type Object<Ctx: drm::DeviceContext> = gem::Object<NovaObject,
 Ctx>;

     type ParentDevice<Ctx: DeviceContext> = auxiliary::Device<Ctx>;

drivers/gpu/drm/tyr/driver.rs +0 -0

index 747745d23f31..7ac3707823b6 100644
@@ -25,7 +25,8 @@
          aref::ARef,

         Mutex, //
     },
-    time, //
+    time,
+    types::ForLt, //
 };

 use crate::{

drivers/gpu/drm/tyr/driver.rs +0 -0

@@ -133,7 +134,7 @@ fn probe(
          });

         let tdev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?; -        let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), 0)?;
+        let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), (), 0)?;

         let driver = TyrPlatformDriverData {
             _device: tdev.into(),

drivers/gpu/drm/tyr/driver.rs +1 -0

@@ -175,6 +176,7 @@ fn drop(self: Pin<&mut Self>) {
  #[vtable]
  impl drm::Driver for TyrDrmDriver {
      type Data = TyrDrmDeviceData;
+    type RegistrationData = ForLt!(());
      type File = TyrDrmFileData;
      type Object<R: drm::DeviceContext> = drm::gem::Object<TyrObject,
 R>;

     type ParentDevice<Ctx: DeviceContext> = platform::Device<Ctx>;

rust/kernel/drm/device.rs +0 -0

index bb685165032d..11edbe6f9f42 100644
@@ -23,6 +23,7 @@

         AlwaysRefCounted, //
     },
     types::{
+        ForLt,
         NotThreadSafe,
         Opaque, //
     },

rust/kernel/drm/device.rs +1 -0

@@ -35,6 +36,7 @@
  };
  use core::{
      alloc::Layout,
+    cell::UnsafeCell,
      marker::PhantomData,
      mem,
      ops::Deref,

@@ -239,6 +241,9 @@ pub fn new(
              unsafe { bindings::drm_dev_put(drm_dev) };
          })?;

+        // SAFETY: raw_drm is valid; no concurrent access before registration.
+        unsafe { (*raw_drm.as_ptr()).registration_data = UnsafeCell::new(NonNull::dangling()) };
+
         // SAFETY: The reference count is one, and now we take ownership of that reference as a
         // drm::Device.
         // INVARIANT: We just created the device above, but have yet to call drm_dev_register.

rust/kernel/drm/device.rs +1 -0

@@ -270,6 +275,7 @@ pub fn new(
  pub struct Device<T: drm::Driver, C: DeviceContext = Registered> {
      dev: Opaque<bindings::drm_device>,
      data: T::Data,
+    pub(super) registration_data:
 UnsafeCell<NonNull<<T::RegistrationData as ForLt>::Of<'static>>>,
      _ctx: PhantomData<C>,
  }

rust/kernel/drm/device.rs +0 -0

@@ -278,6 +284,23 @@ pub(crate) fn as_raw(&self) -> *mut
 bindings::drm_device {
          self.dev.get()
      }

+    /// Returns a reference to the registration data with lifetime shortened
+    /// from 'static.
+    ///
+    /// # Safety
+    ///
+    /// The caller must ensure the parent bus device is bound. This is
+    /// typically guaranteed by holding an active drm_dev_enter() critical
+    /// section (e.g. via [UnbindGuard]).
+    #[doc(hidden)]
+    pub unsafe fn raw_registration_data(&self) -> &<T::RegistrationData as ForLt>::Of<'_> {
+        // SAFETY: Caller guarantees the parent bus device is bound, hence
+        // the pointer is valid.
+        let static_ref = unsafe { (*self.registration_data.get()).as_ref() };

rust/kernel/drm/device.rs +4 -0

+
+        T::RegistrationData::cast_ref(static_ref)
+    }
+

     /// # Safety
     ///
     /// ptr must be a valid pointer to a struct device embedded in Self.

rust/kernel/drm/device.rs +0 -0

@@ -391,6 +414,23 @@ pub struct UnbindGuard<'a, T: drm::Driver> {
      idx: i32,
  }

+impl<T: drm::Driver> UnbindGuard<'_, T> {
+    /// Returns a reference to the registration data with its lifetime shortened from 'static
+    /// to the guard's borrow lifetime.
+    ///
+    /// The data is owned by [Registration](drm::driver::Registration) and is guaranteed to +    /// remain valid for the duration of this guard, since +    /// [Registration](drm::driver::Registration)'s drop calls +    /// drm_dev_unplug() which waits for all drm_dev_enter() critical sections to complete.
+    pub fn registration_data(&self) -> &<T::RegistrationData as ForLt>::Of<'_> {
+        // SAFETY: The pointer was set in Registration::new() before drm_dev_register(), and
+        // is only invalidated after drm_dev_unplug() in Registration::drop(). Since we hold
+        // an active drm_dev_enter() critical section, the SRCU barrier in drm_dev_unplug()
+        // guarantees the pointer is still valid.
+        unsafe { self.dev.raw_registration_data() }
+    }

rust/kernel/drm/device.rs +2 -0

+}
+

 impl<T: drm::Driver> Deref for UnbindGuard<'_, T> { type Target = T::ParentDevice<device::Bound>;

rust/kernel/drm/driver.rs +2 -1

index 751a68bb27e1..3a49ef324ada 100644
@@ -11,7 +11,8 @@
      drm,
      error::to_result,
      prelude::*,
-    sync::aref::ARef, //
+    sync::aref::ARef,
+    types::ForLt, //
  };
  use core::{
      mem,

@@ -108,6 +109,16 @@ pub trait Driver {
      /// Context data associated with the DRM driver
      type Data: Sync + Send;

+    /// Data owned by the [Registration] and accessible through [drm::device::UnbindGuard].
+    ///
+    /// This is a [ForLt](trait@ForLt) type whose lifetime is tied to the parent bus
+    /// device binding scope.
+    /// The data is only accessible while the parent bus device is bound (i.e. within a
+    /// drm_dev_enter/exit critical section), and references handed out by
+    /// [UnbindGuard::registration_data()](drm::device::UnbindGuard::regist ration_data) have
+    /// their lifetime shortened accordingly via [ForLt::cast_ref].
+    type RegistrationData: ForLt;
+
     /// The type used to manage memory for this driver. type Object<Ctx: drm::DeviceContext>: AllocImpl;

rust/kernel/drm/driver.rs +0 -0

@@ -127,12 +138,44 @@ pub trait Driver {
  /// The registration type of a `drm::Device`.
  ///
  /// Once the `Registration` structure is dropped, the device is

unregistered.

rust/kernel/drm/driver.rs +4 -1

-pub struct Registration<T: Driver>(ARef<drm::Device<T>>);
+pub struct Registration<T: Driver> {
+    drm: ARef<drm::Device<T>>,
+    #[allow(dead_code)]
+    reg_data: Pin<KBox<<T::RegistrationData as

ForLt>::Of<'static>>>,
+}

-impl<T: Driver> Registration<T> {
-    fn new(drm: drm::UnregisteredDevice<T>, flags: usize) -> Result<Self> {
-        // SAFETY: drm.as_raw() is valid by the invariants of drm::Device.
-        to_result(unsafe { bindings::drm_dev_register(drm.as_raw(), flags) })?;

rust/kernel/drm/driver.rs +7 -0

+impl<T: Driver> Registration<T>
+where
+    for<'a> <T::RegistrationData as ForLt>::Of<'a>: Send,
+{
+    fn new<'bound, E>(
+        drm: drm::UnregisteredDevice<T>,
+        reg_data: impl PinInit<<T::RegistrationData as

ForLt>::Of<'bound>, E>,
+        flags: usize,
+    ) -> Result<Self>
+    where
+        Error: From<E>,
+    {
+        let reg_data: Pin<KBox<<T::RegistrationData as ForLt>::Of<'bound>>> =
+            KBox::pin_init(reg_data, GFP_KERNEL)?;
+
+        // SAFETY: ForLt guarantees covariance; lifetimes do not affect layout.
+        let reg_data: Pin<KBox<<T::RegistrationData as ForLt>::Of<'static>>> =
+            unsafe { mem::transmute(reg_data) };
+
+        // Store the registration data pointer in the device before registration, so that it is
+        // visible once ioctls can be called.
+        //
+        // SAFETY: No concurrent access; the device is not yet registered.
+        unsafe { *drm.registration_data.get() = NonNull::from(Pin::get_ref(reg_data.as_ref())) }
+
+        // SAFETY: drm is a valid, initialized but not yet registered DRM device.
+        let ret = unsafe { bindings::drm_dev_register(drm.as_raw(), flags) };
+        if let Err(e) = to_result(ret) {
+            // SAFETY: No concurrent access; registration failed. +            unsafe { *drm.registration_data.get() = NonNull::dangling() };
+            return Err(e);
+        }

         // SAFETY: We just called drm_dev_register above let new = NonNull::from(unsafe { drm.assume_ctx() });

rust/kernel/drm/driver.rs +0 -0

@@ -144,46 +187,55 @@ fn new(drm: drm::UnregisteredDevice<T>, flags:
 usize) -> Result<Self> {
          // one reference to the device - which we take ownership

over here.
         let new = unsafe { ARef::from_raw(new) };

-        Ok(Self(new))
+        Ok(Self { drm: new, reg_data })
     }

     /// Registers a new [UnregisteredDevice](drm::UnregisteredDevice) with userspace. ///
     /// Ownership of the [Registration] object is passed to [devres::register].
-    pub fn new_foreign_owned<'a>(
+    pub fn new_foreign_owned<'bound, E>(
         drm: drm::UnregisteredDevice<T>,
-        dev: &'a device::Device<device::Bound>,
+        dev: &'bound device::Device<device::Bound>,
+        reg_data: impl PinInit<<T::RegistrationData as ForLt>::Of<'bound>, E>,
         flags: usize,
-    ) -> Result<&'a drm::Device<T>>
+    ) -> Result<&'bound drm::Device<T>>
     where
         T: 'static,
+        Error: From<E>,
     {
         if drm.as_ref().as_raw() != dev.as_raw() {
             return Err(EINVAL);
         }

-        let reg = Registration::<T>::new(drm, flags)?;
+        let reg = Registration::<T>::new(drm, reg_data, flags)?; let drm = NonNull::from(reg.device());

-        devres::register(dev, reg, GFP_KERNEL)?;
+        devres::register::<_, core::convert::Infallible>(dev, reg, GFP_KERNEL)?;

         // SAFETY: Since reg was passed to devres::register(), the device now owns the lifetime
-        // of the DRM registration - ensuring that this references lives for at least as long as 'a.
+        // of the DRM registration - ensuring that this reference lives for
+        // at least as long as 'bound.
         Ok(unsafe { drm.as_ref() })
     }

     /// Returns a reference to the Device instance for this registration.
     pub fn device(&self) -> &drm::Device<T> {
-        &self.0
+        &self.drm
     }
 }

 // SAFETY: Registration doesn't offer any methods or access to fields when shared between
 // threads, hence it's safe to share it.

rust/kernel/drm/driver.rs +4 -1

-unsafe impl<T: Driver> Sync for Registration<T> {}
+unsafe impl<T: Driver> Sync for Registration<T> where
+    for<'a> <T::RegistrationData as ForLt>::Of<'a>: Send
+{
+}

 // SAFETY: Registration with and unregistration from the DRM subsystem can happen from any thread.

rust/kernel/drm/driver.rs +4 -1

-unsafe impl<T: Driver> Send for Registration<T> {}
+unsafe impl<T: Driver> Send for Registration<T> where
+    for<'a> <T::RegistrationData as ForLt>::Of<'a>: Send
+{
+}

 impl<T: Driver> Drop for Registration<T> {
     fn drop(&mut self) {

rust/kernel/drm/driver.rs +0 -0

@@ -195,6 +247,9 @@ fn drop(&mut self) {
          //
          // SAFETY: Safe by the invariant of `ARef<drm::Device<T>>`.

The existence of this
         // Registration also guarantees that this drm::Device is actually registered.
-        unsafe { bindings::drm_dev_unplug(self.0.as_raw()) }; +        unsafe { bindings::drm_dev_unplug(self.drm.as_raw()) }; +        // After drm_dev_unplug(), the SRCU barrier guarantees that all UnbindGuard critical
+        // sections have completed, so no one holds a reference to reg_data anymore.
+        // reg_data is dropped here automatically.
     }
 }

rust/kernel/drm/mod.rs +1 -0

index 64a43cb0fe57..6c0ba9c82b92 100644
@@ -11,6 +11,7 @@
  pub use self::device::Device;
  pub use self::device::DeviceContext;
  pub use self::device::Registered;
+pub use self::device::UnbindGuard;
  pub use self::device::Uninit;
  pub use self::device::UnregisteredDevice;
  pub use self::driver::Driver;

So I just realized while working on rebasing rvkms - I'm not sure RegistrationData is the right name for this. If you recall, I described
3 different DeviceContext types in the patches I sent for adding DeviceContext and explicitly mentioned one of them isn't used yet:

* Uninit
* Initialized (the unused one)
* Registered

The thing is we probably want the RegistrationData available starting from Initialized, not from Registered. The reason being - setting up a
DRM device with KMS support can often require performing a modeset _before_ the device is registered.

Furthermore, the C callbacks that are used for such modesets are exactly the same callbacks used for modesets after registration - which
implies that the DeviceContext we'll be working with in nearly all of the modeset callbacks is going to be &Device<T, Initialized> - not &Device<T, Registered>. And as you might imagine, it would be pretty painful for a KMS driver not to be able to use RegistrationData from any of its modesetting callbacks.

We don't specify a type for Initialized yet, but in preparation for that we probably should give this a name such as DeviceData or DriverData - not RegistrationData.

Quoted 438 lines · Danilo Krummrich

Add a RegistrationData associated type to drm::Driver. This is a ForLt
type whose lifetime is tied to the parent bus device binding scope.

Registration<T> takes ownership of the data via Pin<KBox<_>>, erasing
the lifetime to 'static for storage. The pointer is written to drm::Device before drm_dev_register() to ensure it is already in place
when ioctls arrive.

UnbindGuard::registration_data() provides access with the lifetime shortened from 'static via ForLt::cast_ref. Since Registration::drop()
calls drm_dev_unplug() -- which performs an SRCU barrier waiting for
all
drm_dev_enter() critical sections to complete -- the data is guaranteed
to remain valid for the duration of any UnbindGuard.

Signed-off-by Danilo Krummrich <[email protected]>

---
 drivers/gpu/drm/nova/driver.rs |  6 ++- drivers/gpu/drm/tyr/driver.rs  |  6 ++- rust/kernel/drm/device.rs      | 40 +++++++++++++++ rust/kernel/drm/driver.rs      | 89 +++++++++++++++++++++++++++--- --
--
 rust/kernel/drm/mod.rs         |  1 +

 5 files changed, 121 insertions(+), 21 deletions(-)

drivers/gpu/drm/nova/driver.rs +0 -0

index 9d4100f01ea7..54a3391371ba 100644
@@ -12,7 +12,8 @@

         ioctl, //
     },
     prelude::*,
-    sync::aref::ARef, //
+    sync::aref::ARef,
+    types::ForLt, //
 };

 use crate::file::File;

drivers/gpu/drm/nova/driver.rs +0 -0

@@ -63,7 +64,7 @@ fn probe(
          let data = try_pin_init!(NovaData { adev: adev.into() });

         let drm = drm::UnregisteredDevice::<Self>::new(adev, data)?;
-        let drm = drm::Registration::new_foreign_owned(drm, adev.as_ref(), 0)?;
+        let drm = drm::Registration::new_foreign_owned(drm, adev.as_ref(), (), 0)?;

         Ok(Self { drm: drm.into() })
     }

drivers/gpu/drm/nova/driver.rs +1 -0

@@ -72,6 +73,7 @@ fn probe(
  #[vtable]
  impl drm::Driver for NovaDriver {
      type Data = NovaData;
+    type RegistrationData = ForLt!(());
      type File = File;
      type Object<Ctx: drm::DeviceContext> = gem::Object<NovaObject,
 Ctx>;

     type ParentDevice<Ctx: DeviceContext> =
auxiliary::Device<Ctx>;

drivers/gpu/drm/tyr/driver.rs +0 -0

index 747745d23f31..7ac3707823b6 100644
@@ -25,7 +25,8 @@
          aref::ARef,

         Mutex, //
     },
-    time, //
+    time,
+    types::ForLt, //
 };

 use crate::{

drivers/gpu/drm/tyr/driver.rs +0 -0

@@ -133,7 +134,7 @@ fn probe(
          });

         let tdev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?; -        let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), 0)?;
+        let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), (),
0)?;

         let driver = TyrPlatformDriverData {
             _device: tdev.into(),

drivers/gpu/drm/tyr/driver.rs +1 -0

@@ -175,6 +176,7 @@ fn drop(self: Pin<&mut Self>) {
  #[vtable]
  impl drm::Driver for TyrDrmDriver {
      type Data = TyrDrmDeviceData;
+    type RegistrationData = ForLt!(());
      type File = TyrDrmFileData;

     type Object<R: drm::DeviceContext> = drm::gem::Object<TyrObject,
R>;
     type ParentDevice<Ctx: DeviceContext> = platform::Device<Ctx>;

rust/kernel/drm/device.rs +0 -0

index bb685165032d..11edbe6f9f42 100644
@@ -23,6 +23,7 @@

         AlwaysRefCounted, //
     },
     types::{
+        ForLt,
         NotThreadSafe,
         Opaque, //
     },

rust/kernel/drm/device.rs +1 -0

@@ -35,6 +36,7 @@
  };
  use core::{
      alloc::Layout,
+    cell::UnsafeCell,
      marker::PhantomData,
      mem,
      ops::Deref,

@@ -239,6 +241,9 @@ pub fn new(
              unsafe { bindings::drm_dev_put(drm_dev) };
          })?;

+        // SAFETY: raw_drm is valid; no concurrent access before registration.
+        unsafe { (*raw_drm.as_ptr()).registration_data = UnsafeCell::new(NonNull::dangling()) };
+
         // SAFETY: The reference count is one, and now we take ownership of that reference as a
         // drm::Device.
         // INVARIANT: We just created the device above, but have yet
to call drm_dev_register.

rust/kernel/drm/device.rs +1 -0

@@ -270,6 +275,7 @@ pub fn new(
  pub struct Device<T: drm::Driver, C: DeviceContext = Registered> {
      dev: Opaque<bindings::drm_device>,
      data: T::Data,
+    pub(super) registration_data:
 UnsafeCell<NonNull<<T::RegistrationData as ForLt>::Of<'static>>>,
      _ctx: PhantomData<C>,
  }

rust/kernel/drm/device.rs +0 -0

@@ -278,6 +284,23 @@ pub(crate) fn as_raw(&self) -> *mut
 bindings::drm_device {
          self.dev.get()
      }

+    /// Returns a reference to the registration data with lifetime shortened
+    /// from 'static.
+    ///
+    /// # Safety
+    ///
+    /// The caller must ensure the parent bus device is bound. This
is
+    /// typically guaranteed by holding an active drm_dev_enter()
critical
+    /// section (e.g. via [UnbindGuard]).
+    #[doc(hidden)]
+    pub unsafe fn raw_registration_data(&self) -> &<T::RegistrationData as ForLt>::Of<'_> {
+        // SAFETY: Caller guarantees the parent bus device is bound,
hence
+        // the pointer is valid.
+        let static_ref = unsafe { (*self.registration_data.get()).as_ref() };

rust/kernel/drm/device.rs +4 -0

+
+        T::RegistrationData::cast_ref(static_ref)
+    }
+

     /// # Safety
     ///
     /// ptr must be a valid pointer to a struct device embedded
in Self.

rust/kernel/drm/device.rs +0 -0

@@ -391,6 +414,23 @@ pub struct UnbindGuard<'a, T: drm::Driver> {
      idx: i32,
  }

+impl<T: drm::Driver> UnbindGuard<'_, T> {
+    /// Returns a reference to the registration data with its lifetime shortened from 'static
+    /// to the guard's borrow lifetime.
+    ///
+    /// The data is owned by [Registration](drm::driver::Registration) and is guaranteed to +    /// remain valid for the duration of this guard, since +    /// [Registration](drm::driver::Registration)'s drop calls +    /// drm_dev_unplug() which waits for all drm_dev_enter() critical sections to complete.
+    pub fn registration_data(&self) -> &<T::RegistrationData as ForLt>::Of<'_> {
+        // SAFETY: The pointer was set in Registration::new() before drm_dev_register(), and
+        // is only invalidated after drm_dev_unplug() in Registration::drop(). Since we hold
+        // an active drm_dev_enter() critical section, the SRCU barrier in drm_dev_unplug()
+        // guarantees the pointer is still valid.
+        unsafe { self.dev.raw_registration_data() }
+    }

rust/kernel/drm/device.rs +2 -0

+}
+

 impl<T: drm::Driver> Deref for UnbindGuard<'_, T> { type Target = T::ParentDevice<device::Bound>;

rust/kernel/drm/driver.rs +2 -1

index 751a68bb27e1..3a49ef324ada 100644
@@ -11,7 +11,8 @@
      drm,
      error::to_result,
      prelude::*,
-    sync::aref::ARef, //
+    sync::aref::ARef,
+    types::ForLt, //
  };
  use core::{
      mem,

@@ -108,6 +109,16 @@ pub trait Driver {
      /// Context data associated with the DRM driver
      type Data: Sync + Send;

+    /// Data owned by the [Registration] and accessible through [drm::device::UnbindGuard].
+    ///
+    /// This is a [ForLt](trait@ForLt) type whose lifetime is tied
to the parent bus
+    /// device binding scope.
+    /// The data is only accessible while the parent bus device is bound (i.e. within a
+    /// drm_dev_enter/exit critical section), and references handed out by
+    /// [UnbindGuard::registration_data()](drm::device::UnbindGuard::regi st
ration_data) have
+    /// their lifetime shortened accordingly via [ForLt::cast_ref].
+    type RegistrationData: ForLt;
+
     /// The type used to manage memory for this driver. type Object<Ctx: drm::DeviceContext>: AllocImpl;

rust/kernel/drm/driver.rs +0 -0

@@ -127,12 +138,44 @@ pub trait Driver {
  /// The registration type of a `drm::Device`.
  ///
  /// Once the `Registration` structure is dropped, the device is

unregistered.

rust/kernel/drm/driver.rs +4 -1

-pub struct Registration<T: Driver>(ARef<drm::Device<T>>);
+pub struct Registration<T: Driver> {
+    drm: ARef<drm::Device<T>>,
+    #[allow(dead_code)]
+    reg_data: Pin<KBox<<T::RegistrationData as

ForLt>::Of<'static>>>,
+}

-impl<T: Driver> Registration<T> {
-    fn new(drm: drm::UnregisteredDevice<T>, flags: usize) -> Result<Self> {
-        // SAFETY: drm.as_raw() is valid by the invariants of drm::Device.
-        to_result(unsafe { bindings::drm_dev_register(drm.as_raw(),
flags) })?;

rust/kernel/drm/driver.rs +7 -0

+impl<T: Driver> Registration<T>
+where
+    for<'a> <T::RegistrationData as ForLt>::Of<'a>: Send,
+{
+    fn new<'bound, E>(
+        drm: drm::UnregisteredDevice<T>,
+        reg_data: impl PinInit<<T::RegistrationData as

ForLt>::Of<'bound>, E>,
+        flags: usize,
+    ) -> Result<Self>
+    where
+        Error: From<E>,
+    {
+        let reg_data: Pin<KBox<<T::RegistrationData as ForLt>::Of<'bound>>> =
+            KBox::pin_init(reg_data, GFP_KERNEL)?;
+
+        // SAFETY: ForLt guarantees covariance; lifetimes do not affect layout.
+        let reg_data: Pin<KBox<<T::RegistrationData as ForLt>::Of<'static>>> =
+            unsafe { mem::transmute(reg_data) };
+
+        // Store the registration data pointer in the device before
registration, so that it is
+        // visible once ioctls can be called.
+        //
+        // SAFETY: No concurrent access; the device is not yet registered.
+        unsafe { *drm.registration_data.get() = NonNull::from(Pin::get_ref(reg_data.as_ref())) }
+
+        // SAFETY: drm is a valid, initialized but not yet registered DRM device.
+        let ret = unsafe { bindings::drm_dev_register(drm.as_raw(),
flags) };
+        if let Err(e) = to_result(ret) {
+            // SAFETY: No concurrent access; registration failed. +            unsafe { *drm.registration_data.get() = NonNull::dangling() };
+            return Err(e);
+        }

         // SAFETY: We just called drm_dev_register above let new = NonNull::from(unsafe { drm.assume_ctx() });

rust/kernel/drm/driver.rs +0 -0

@@ -144,46 +187,55 @@ fn new(drm: drm::UnregisteredDevice<T>,

flags:
usize) -> Result<Self> {
         // one reference to the device - which we take ownership over here.
         let new = unsafe { ARef::from_raw(new) };

-        Ok(Self(new))
+        Ok(Self { drm: new, reg_data })
     }

     /// Registers a new [UnregisteredDevice](drm::UnregisteredDevice) with userspace. ///
     /// Ownership of the [Registration] object is passed to [devres::register].
-    pub fn new_foreign_owned<'a>(
+    pub fn new_foreign_owned<'bound, E>(
         drm: drm::UnregisteredDevice<T>,
-        dev: &'a device::Device<device::Bound>,
+        dev: &'bound device::Device<device::Bound>,
+        reg_data: impl PinInit<<T::RegistrationData as ForLt>::Of<'bound>, E>,
         flags: usize,
-    ) -> Result<&'a drm::Device<T>>
+    ) -> Result<&'bound drm::Device<T>>
     where
         T: 'static,
+        Error: From<E>,
     {
         if drm.as_ref().as_raw() != dev.as_raw() { return Err(EINVAL);
         }

-        let reg = Registration::<T>::new(drm, flags)?; +        let reg = Registration::<T>::new(drm, reg_data, flags)?; let drm = NonNull::from(reg.device());

-        devres::register(dev, reg, GFP_KERNEL)?;
+        devres::register::<_, core::convert::Infallible>(dev, reg, GFP_KERNEL)?;

         // SAFETY: Since reg was passed to devres::register(), the
device now owns the lifetime
-        // of the DRM registration - ensuring that this references lives for at least as long as 'a.
+        // of the DRM registration - ensuring that this reference lives for
+        // at least as long as 'bound.
         Ok(unsafe { drm.as_ref() })
     }

     /// Returns a reference to the Device instance for this registration.
     pub fn device(&self) -> &drm::Device<T> {
-        &self.0
+        &self.drm
     }
 }

 // SAFETY: Registration doesn't offer any methods or access to fields when shared between
 // threads, hence it's safe to share it.

rust/kernel/drm/driver.rs +4 -1

-unsafe impl<T: Driver> Sync for Registration<T> {}
+unsafe impl<T: Driver> Sync for Registration<T> where
+    for<'a> <T::RegistrationData as ForLt>::Of<'a>: Send
+{
+}

 // SAFETY: Registration with and unregistration from the DRM subsystem can happen from any thread.

rust/kernel/drm/driver.rs +4 -1

-unsafe impl<T: Driver> Send for Registration<T> {}
+unsafe impl<T: Driver> Send for Registration<T> where
+    for<'a> <T::RegistrationData as ForLt>::Of<'a>: Send
+{
+}

 impl<T: Driver> Drop for Registration<T> {
     fn drop(&mut self) {

rust/kernel/drm/driver.rs +0 -0

@@ -195,6 +247,9 @@ fn drop(&mut self) {
          //
          // SAFETY: Safe by the invariant of

ARef<drm::Device<T>>.
The existence of this
         // Registration also guarantees that this drm::Device is
actually registered.
-        unsafe { bindings::drm_dev_unplug(self.0.as_raw()) }; +        unsafe { bindings::drm_dev_unplug(self.drm.as_raw()) }; +        // After drm_dev_unplug(), the SRCU barrier guarantees that
all UnbindGuard critical
+        // sections have completed, so no one holds a reference to reg_data anymore.
+        // reg_data is dropped here automatically.
     }
 }

rust/kernel/drm/mod.rs +1 -0

index 64a43cb0fe57..6c0ba9c82b92 100644
@@ -11,6 +11,7 @@
  pub use self::device::Device;
  pub use self::device::DeviceContext;
  pub use self::device::Registered;
+pub use self::device::UnbindGuard;
  pub use self::device::Uninit;
  pub use self::device::UnregisteredDevice;
  pub use self::driver::Driver;

FWIW: now that I've noticed this, that might simplify things w/r/t what
KMS needs here from DeviceContext and allow me to go from modeling DeviceContext around 3 stages (Uninit, Initialized, Registered), to just 2 stages (Initialized, Registered). The purpose of having a separate Uninit and Initialized had been to workaround not having access to drm::Driver::Data when a driver performs an atomic commit before userspace registration, which would be a big ergonomic issue for
implementing a lot of atomic KMS callbacks.

But if that's not an issue with this patch series, then it probably makes more sense for me to respin that DeviceContext patch series to reflect that since that simplifies things a lot for the KMS side. For your patch series, it just means you have to replace "Uninit" with "Initialized" in the next version.

I will send out a respin with this tomorrow after working on respinning
the gem shmem patch series, since that shouldn't take me very long at all.

Danilo Krummrich (6):
rust: drm: Add Driver::ParentDevice associated type
rust: drm: Add UnbindGuard for drm_dev_enter/exit critical sections
rust: drm: Add RegistrationData to drm::Driver
rust: drm: Wrap ioctl dispatch in UnbindGuard
rust: drm: Pass registration data to ioctl handlers
rust: drm: Pass bound parent device to ioctl handlers

Quoted 7 lines · Danilo Krummrich

Danilo Krummrich (6):
rust: drm: Add Driver::ParentDevice associated type
rust: drm: Add UnbindGuard for drm_dev_enter/exit critical sections
rust: drm: Add RegistrationData to drm::Driver
rust: drm: Wrap ioctl dispatch in UnbindGuard
rust: drm: Pass registration data to ioctl handlers
rust: drm: Pass bound parent device to ioctl handlers

Deborah, following up on your question in the other thread, this is roughly how you'd use this in Tyr.

drivers/gpu/drm/tyr/driver.rs +10 -4

index 7ac3707823b6..447e53c0eecf 100644
@@ -37,13 +37,17 @@
     regs, //
 };
 
-pub(crate) type IoMem = kernel::io::Mmio<SZ_2M>;
+pub(crate) type IoMem<'bound> = kernel::io::mem::IoMem<'bound, SZ_2M>;
 
 pub(crate) struct TyrDrmDriver;
 
 /// Convenience type alias for the DRM device type for this driver.
 pub(crate) type TyrDrmDevice<Ctx = drm::Registered> = drm::Device<TyrDrmDriver, Ctx>;
 
+pub(crate) struct RegData<'bound> {
+    pub(crate) iomem: IoMem<'bound>,
+}
+
 #[pin_data(PinnedDrop)]
 pub(crate) struct TyrPlatformDriverData {
     _device: ARef<TyrDrmDevice>,

@@ -65,7 +69,7 @@ pub(crate) struct TyrDrmDeviceData {
     pub(crate) gpu_info: GpuInfo,
 }
 
-fn issue_soft_reset(dev: &Device<Bound>, iomem: &IoMem) -> Result {
+fn issue_soft_reset(dev: &Device<Bound>, iomem: &IoMem<'_>) -> Result {
     regs::GPU_CMD.write(iomem, regs::GPU_CMD_SOFT_RESET);
 
     poll::read_poll_timeout(

@@ -133,8 +137,10 @@ fn probe(
                 gpu_info,
         });
 
+        let reg_data = RegData { iomem };
+
         let tdev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;
-        let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), (), 0)?;
+        let tdev = drm::driver::Registration::new_foreign_owned(tdev, pdev.as_ref(), reg_data, 0)?;
 
         let driver = TyrPlatformDriverData {
             _device: tdev.into(),

@@ -176,7 +182,7 @@ fn drop(self: Pin<&mut Self>) {
 #[vtable]
 impl drm::Driver for TyrDrmDriver {
     type Data = TyrDrmDeviceData;
-    type RegistrationData = ForLt!(());
+    type RegistrationData = ForLt!(for<'a> RegData<'a>);
     type File = TyrDrmFileData;
     type Object<R: drm::DeviceContext> = drm::gem::Object<TyrObject, R>;
     type ParentDevice<Ctx: DeviceContext> = platform::Device<Ctx>;

drivers/gpu/drm/tyr/file.rs +4 -1

index 9f53da7633ab..30efdf924cc2 100644
@@ -10,6 +10,7 @@
 };
 
 use crate::driver::{
+    RegData,
     TyrDrmDevice,
     TyrDrmDriver, //
 };

@@ -32,10 +33,12 @@ impl TyrDrmFileData {
     pub(crate) fn dev_query(
         ddev: &TyrDrmDevice,
         _pdev: &platform::Device<device::Bound>,
-        _reg_data: &(),
+        reg_data: &RegData<'_>,
         devquery: &mut uapi::drm_panthor_dev_query,
         _file: &TyrDrmFile,
     ) -> Result<u32> {
+        let _iomem = reg_data.iomem;
+
         if devquery.pointer == 0 {
             match devquery.type_ {
                 uapi::drm_panthor_dev_query_type_DRM_PANTHOR_DEV_QUERY_GPU_INFO => {

drivers/gpu/drm/tyr/gpu.rs +2 -2

index bb0473c85bf7..f169fb1ccc03 100644
@@ -34,7 +34,7 @@
 pub(crate) struct GpuInfo(pub(crate) uapi::drm_panthor_gpu_info);
 
 impl GpuInfo {
-    pub(crate) fn new(iomem: &IoMem) -> Self {
+    pub(crate) fn new(iomem: &IoMem<'_>) -> Self {
         let gpu_id = regs::GPU_ID.read(iomem);
         let csf_id = regs::GPU_CSF_ID.read(iomem);
         let gpu_rev = regs::GPU_REVID.read(iomem);

@@ -206,7 +206,7 @@ fn from(value: u32) -> Self {
 }
 
 /// Powers on the l2 block.
-pub(crate) fn l2_power_on(dev: &Device<Bound>, iomem: &IoMem) -> Result {
+pub(crate) fn l2_power_on(dev: &Device<Bound>, iomem: &IoMem<'_>) -> Result {
     regs::L2_PWRON_LO.write(iomem, 1);
 
     poll::read_poll_timeout(

drivers/gpu/drm/tyr/regs.rs +2 -2

index 0881b3812afd..2b0da6019512 100644
@@ -20,12 +20,12 @@
 
 impl<const OFFSET: usize> Register<OFFSET> {
     #[inline]
-    pub(crate) fn read(&self, iomem: &IoMem) -> u32 {
+    pub(crate) fn read(&self, iomem: &IoMem<'_>) -> u32 {
         iomem.read32(OFFSET)
     }
 
     #[inline]
-    pub(crate) fn write(&self, iomem: &IoMem, value: u32) {
+    pub(crate) fn write(&self, iomem: &IoMem<'_>, value: u32) {
         iomem.write32(value, OFFSET);
     }
 }

let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;

Quoted 1 line · Deborah Brouwer

let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;

You shouldn't need this anymore as the drm::Registration itself has private data now that is bound to the lifetime of the underlying bus device, which should be the correct lifetime for juggling the GPU page tables.

Quoted 9 lines · On Thu, 14 May 2026 21:07:11 +0200 "Danilo Krummrich" <[email protected]> wrote:

Quoted 2 lines · Deborah Brouwer

let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;

You shouldn't need this anymore as the drm::Registration itself has private data
now that is bound to the lifetime of the underlying bus device, which should be
the correct lifetime for juggling the GPU page tables.

The problem we have is that, to initialize some of the sub-components of the driver, we need to be able to allocate GEM objects before the DRM
device is exposed (registered), and because the data we want to attach
to the final registration contains these sub-components, we need to defer the data assignment to the registration step (which was allowed by [1], but apparently this was dropped from the latest version of the series for some reason).

[1]
https://lore.kernel.org/dri-devel/20260320233645.950190-4-lyude@redha
t.com/

Quoted 6 lines · On Thu, 14 May 2026 21:07:11 +0200 "Danilo Krummrich" <[email protected]> wrote:

Quoted 1 line · Deborah Brouwer

let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;

You shouldn't need this anymore as the drm::Registration itself has private data now that is bound to the lifetime of the underlying bus device, which should be the correct lifetime for juggling the GPU page tables.

The problem we have is that, to initialize some of the sub-components of the driver, we need to be able to allocate GEM objects before the DRM device is exposed (registered), and because the data we want to attach to the final registration contains these sub-components, we need to defer the data assignment to the registration step (which was allowed by [1], but apparently this was dropped from the latest version of the series for some reason).

Quoted 10 lines · Boris Brezillon

Quoted 6 lines · On Thu, 14 May 2026 21:07:11 +0200 "Danilo Krummrich" <[email protected]> wrote:

Quoted 1 line · Deborah Brouwer

let unreg_dev = drm::UnregisteredDevice::<TyrDrmDriver>::new(pdev, data)?;

You shouldn't need this anymore as the drm::Registration itself has private data now that is bound to the lifetime of the underlying bus device, which should be the correct lifetime for juggling the GPU page tables.

Quoted 7 lines

The problem we have is that, to initialize some of the sub-components of the driver, we need to be able to allocate GEM objects before the DRM device is exposed (registered), and because the data we want to attach to the final registration contains these sub-components, we need to defer the data assignment to the registration step (which was allowed by [1], but apparently this was dropped from the latest version of the series for some reason).

I'm perfectly aware, what I'm saying above is that you probably want to store those GEM objects (that you can create with the previously allocated drm::Device) in the drm::Registration data. This fulfills this requirement *and* ties the lifetime of those GEM objects to the lifetime of the underlying bus device being bound to the driver, which is exactly what you want for GEM objects that contain the device page tables.

So, GEM allocation and GPUVM are required are required early on, and both want a drm::Device of some sort (Unregistered or Registered). So the question is, are you happy with having [1] applied before/after your patchset to address this chicken-and-egg issue I mentioned,

or are you proposing something else (Option<Subcomponent> so that we start with all sub-components set to None and progressively populate those, which I remember Daniel was strongly opposed to)?

Quoted 4 lines · Boris Brezillon

So, GEM allocation and GPUVM are required are required early on, and both want a drm::Device of some sort (Unregistered or Registered). So the question is, are you happy with having [1] applied before/after your patchset to address this chicken-and-egg issue I mentioned,

Yes, this is exactly what I had in mind for all of my replies, but I think I only implied my key point rather than making it explicit, so let me do that now.

What I'm saying is that we now have all DRM ioctls behind the SRCU guard, which means that the drm::Registration data is always available from DRM ioctls.

Now, with this precondition, the real question is whether there are any resources left that should be bound to the lifetime of the DRM device itself, which I don't think is the case.

After device unbind nothing is able to call back into the driver anymore, so there is no reason to keep the corresponding data alive within the driver's private data.

There may be resources that are kept alive through a separate reference count while userspace still has open file descriptors, but they are separate reference counts and should be independent from the driver's private data.

IWO, the fact that we guard the ioctls makes the whole class of problems go away that we inherit from having to keep the driver's private data alive until after remvoe() -- the DRM device private data becomes obsolete and we should probably evene remove it.

Instead, we should use the drm::Registration private data for everything.

With this, your chicken-and-egg issue is already solved; the DRM device is available, you can populate all the resources you need (GEM, GPUVM, etc.) and then pass it into drm::Registration::new().

In terms of making any of the resources you store in the drm::Registration data available in the bus device private data, it becomes the same pattern as for everything else, i.e. you need shared ownership.

So, let's say you need IoMem<'bound> in both the drm::Registration data and in the bus device private data, then you currently need Arc<IoMem<'bound>> in both of them, which is fine, but I think we can do better.

Eventually, once we have landed the series I currently have in flight and once Gary finished his self-referencial support in pin-init, I think we can even avoid the reference count. Here is an example.

	struct TyrPlatformDriverData<'bound> {
	    _device: ARef<TyrDrmDevice>,
	    _reg: drm::Registration<'bound, TyrDrmData<'_>>,
	    iomem: IoMem<'bound>,
	}

	struct TyrDrmData<'bound> {
	    iomem: &'bound IoMem<'bound>,
	}

	fn probe() -> ... {
	    try_pin_init!(TyrPlatformDriverData {
	        _device: ...,
		iomem <- ...,
		_reg <- drm::Registration::new(..., TyrDrmData { iomem: &iomem }),
	    })
	}

I don't know how the pin-init self-referencial stuff will exactly turn out, but this is pretty much what I hope we can evolve this into.

(And sorry again, now that I spelled this all out, having that left implicit in my first reply was obviously unreasonable. :)

Quoted 4 lines

or are you proposing something else (Option<Subcomponent> so that we start with all sub-components set to None and progressively populate those, which I remember Daniel was strongly opposed to)?

No, I am strongly opposed to do that (as well).