Refactor physical pointer API by sangho2 · Pull Request #824 · microsoft/litebox

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) · 2026-05-01T22:48:34Z

This PR refactors the physical pointer API.

Weidong Cui (wdcui) · 2026-06-12T16:35:02Z

Weiteng Chen (@CvvT) I think we should take a look at this PR as well. Thanks!

Weidong Cui (wdcui)

I left some comments below. I'm confident about my review because this PR has a lot of subtlties, so I didn't approve it and asked Weiteng to take a look at it as well.

Leon Schuermann (lschuermann)

I want to take a slightly more in-depth pass over lib.rs, but otherwise this looks pretty good to me!

It's hard to judge what this + the other changes in #817 look like. Is it work merging this one into the sanghle/lvbs/vmap_copy branch first, and then doing another thorough pass over the merged result to make sure it's consistent?

Given the comparisons between this infrastructure and DMA, maybe it's worth looking at tock/tock#4702? That PR to Tock addresses two separate but related concerns:

It prevents the Rust compiler from making incorrect assumptions about the state of memory it can dereference (Rust slices). This is not directly applicable here, as memory is only ever accessed through asm!()-backed memcpy helpers, so there is no buffer with "shared custody" between Rust and the foreign entity.
It emits the appropriate synchronization instructions (i.e., fences) for when Rust-issued writes need to be made visible to the foreign entity, or when foreign-issued writes need to be made visible to Rust. This may still be missing here.

github-actions · 2026-06-18T15:55:14Z

ℹ️ Note: This semver check was run against the sanghle/lvbs/vmap_copy branch, not main or ulitebox.

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure derive_trait_impl_removed: built-in derived trait no longer implemented ---
Description:
A public type has stopped deriving one or more traits. This can break downstream code that depends on those types implementing those traits.
ref: https://doc.rust-lang.org/reference/attributes/derive.html#derive
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/derive_trait_impl_removed.ron
Failed in:
type PhysConstPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:417
type PhysMutPtr no longer derives Clone, in /home/runner/work/litebox/litebox/litebox_common_linux/src/physical_pointers.rs:88
--- failure struct_missing: pub struct removed or renamed ---
Description:
A publicly-visible struct cannot be imported by its prior path. A `pub use` may have been removed, or the struct itself may have been renamed or removed entirely.
ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/struct_missing.ron
Failed in:
struct litebox_common_linux::vmap::PhysPageMapInfo, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-sanghle_lvbs_vmap_copy/acd6ae561116135b6915cf113a535d2c2e02cfc9/litebox_common_linux/src/vmap.rs:111
--- failure trait_associated_type_added: non-sealed public trait added associated type without default value ---
Description:
A non-sealed trait has gained an associated type without a default value, which breaks downstream implementations of the trait
ref: https://doc.rust-lang.org/cargo/reference/semver.html#trait-new-item-no-default
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_associated_type_added.ron
Failed in:
trait associated type litebox_common_linux::vmap::VmapManager::MapInfo in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:22
--- failure trait_unsafe_added: pub trait became unsafe ---
Description:
A publicly-visible trait became `unsafe`, so implementing it now requires an `unsafe impl` block.
ref: https://doc.rust-lang.org/book/ch19-01-unsafe-rust.html#implementing-an-unsafe-trait
impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/trait_unsafe_added.ron
Failed in:
trait litebox_common_linux::vmap::VmapManager in file /home/runner/work/litebox/litebox/litebox_common_linux/src/vmap.rs:19

This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) added the must-not-merge:prototype An experimental/proof-of-concept PR that must not be merged. label May 1, 2026

Sangho Lee (sangho2) changed the title ~~Physical memory range ownership for safe memory read/write API~~Physical memory range ownership for safe memory APIMay 1, 2026

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch 2 times, most recently from 420bea6 to d0c665cCompare May 2, 2026 03:32

Sangho Lee (sangho2) removed the must-not-merge:prototype An experimental/proof-of-concept PR that must not be merged. label May 2, 2026

Sangho Lee (sangho2) marked this pull request as ready for review May 5, 2026 22:54

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/vmap_copy branch from 8b9b1f7 to 3a833f2Compare May 15, 2026 16:40

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch from 41e36c2 to a6c1102Compare May 15, 2026 16:51

Sangho Lee (sangho2) added the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label May 15, 2026

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch from 2473ace to 27bb1ddCompare May 15, 2026 20:24

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/vmap_copy branch from 24fcce1 to 3dc8650Compare May 21, 2026 20:28

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/vmap_copy branch from 24e1d87 to 9b0f0f0Compare May 29, 2026 02:48

Physical memory range ownership for safe memory API
f6d2dc0

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch from 6dbe423 to f6d2dc0Compare May 29, 2026 04:26

Sangho Lee (sangho2) removed the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label May 29, 2026

Sangho Lee (sangho2) mentioned this pull request May 29, 2026
Improve the safety and security of the Physical Pointer Abstraction #642
Open

Sangho Lee (sangho2) marked this pull request as draft June 2, 2026 16:31

feedback
fc75055

Sangho Lee (sangho2) changed the title ~~Physical memory range ownership for safe memory API~~Physical memory access reservation for safe memory APIJun 2, 2026

Sangho Lee added 3 commits June 2, 2026 17:22

rename
26de96d

drop test
eaaca61

feedback
e322524

Sangho Lee (sangho2) marked this pull request as ready for review June 2, 2026 18:10

Sangho Lee (sangho2) mentioned this pull request Jun 11, 2026
Refactor: Use physical pointer abstraction in LVBS #817
Merged

Weidong Cui (wdcui) requested a review from Weiteng Chen (CvvT)June 12, 2026 16:34

Weidong Cui (wdcui) reviewed Jun 12, 2026
View reviewed changes

Weiteng Chen (CvvT) reviewed Jun 12, 2026
View reviewed changes

Comment threadlitebox_common_linux/src/physical_pointers.rs Outdated
Comment threadlitebox_common_linux/src/physical_pointers.rs Outdated

Weiteng Chen (CvvT) reviewed Jun 13, 2026
View reviewed changes

Comment threadlitebox_platform_lvbs/src/lib.rs Outdated
Comment threadlitebox_common_linux/src/physical_pointers.rs Outdated

Sangho Lee (sangho2) added the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label Jun 15, 2026

revise unmap handling
d5b790b

Sangho Lee (sangho2) marked this pull request as draft June 15, 2026 23:09

Sangho Lee added 3 commits June 15, 2026 23:10

clippy
0ab755b

drop now unneeded mut ref
700f84c

refactoring: drop unneeded unsafe and mut
4e93f35

Leon Schuermann (lschuermann) reviewed Jun 16, 2026
View reviewed changes

drop rollback_on_error
456249b

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch from 8f38930 to 456249bCompare June 18, 2026 13:43

drop phsical addr access reservation
48a276c

Sangho Lee (sangho2) changed the title ~~Physical memory access reservation for safe memory API~~Refactor physical pointer APIJun 18, 2026

Sangho Lee (sangho2) marked this pull request as ready for review June 18, 2026 15:18

Sangho Lee (sangho2) removed the must-not-merge:blocked-on-other-changes Other changes/PRs to be handled first. Label not needed for non-main changes. label Jun 18, 2026

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch from 59f01a7 to 3c7c42fCompare June 18, 2026 15:26

update doc
e81faba

Sangho Lee (sangho2)force-pushed the sanghle/lvbs/physlock_v2 branch from 3c7c42f to e81fabaCompare June 18, 2026 15:47

Sangho Lee (sangho2) merged commit fefb293 into sanghle/lvbs/vmap_copyJun 18, 2026
7 checks passed

Sangho Lee (sangho2) deleted the sanghle/lvbs/physlock_v2 branch June 18, 2026 15:50

Sangho Lee (sangho2) added a commit that referenced this pull request Jun 18, 2026
Refactor physical pointer API (#824)
0e0e307
This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) added a commit that referenced this pull request Jun 30, 2026
Refactor physical pointer API (#824)
71a942f
This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) added a commit that referenced this pull request Jul 9, 2026
Refactor physical pointer API (#824)
e5f3798
This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>

Sangho Lee (sangho2) added a commit that referenced this pull request Jul 10, 2026
Refactor physical pointer API (#824)
c4f4147
This PR refactors the physical pointer API. --------- Co-authored-by: Sangho Lee <sanghle@microsoft.com>