> On 3 Jul 2026, at 04:31, Philipp Stanner <[email protected]> wrote:
>
> Changes since v4:
> - Fix an uninitialized memory bug for FenceCbRegistration with
> ManuallyDrop.
> - Return FenceCtx as impl PinInit
> - Make FenceCtx return an impl PinInit<T, Error> (Danilo)
> - Reformat some comments
> - Adjust the docu for rcu_barrier(), so that it matches the C side's
> docu and our docu for rcu::synchronize_rcu().
>
> Changes since v3:
> - Add a FIXME for an encountered Rust compiler bug. (Gary)
> - Add new Rust files also to DRM drivers & common infrastructure
> MAINTAINERS file. (Danilo)
> - Reposition ECANCELED error code. (Miguel)
> - Replace refcounted FenceCtx in DriverFenceData with a reference plus
> life time. (Boris)
> - Re-add rcu_barrier() patch, since we now can use it for dropping the
> fence context. (Danilo)
> - Add forgotten R-b from Alice, and Acks for MAINTAINERS from
> Christian and Sumit.
>
> Changes since v2:
> - Don't drop DriverFenceData as a whole, but only the members we
> really want to drop. Gives more robustness. (Gary).
> - Break apart large pin_init_from_closure(). (Danilo, Onur)
> - Remove rcu_barrier() and synchronize_rcu() from FenceCtx::drop().
> FenceCtx might drop in atomic context, where you must not perform
> those operations. With the current way C dma_fence is designed, the
> driver must wait for a grace period manually until it unloads.
> - Repair the DriverFenceBorrow implementation, properly injecting a
> life time into it. (Danilo)
> - Fix memory layout bug for rcu_head. (Onur)
> - Drop RCU patches, since this series doesn't need them anymore.
>
> Changes since v1:
> - Remove unnecessary mutable references (Alice)
> - Split up unsafe comments where possible (Danilo)
> - Remove PhantomData + implement FenceCtx ops trait (Boris)
> - Consistently call FenceCtx generic data `T`. FenceDataType is
> derived from that. (Boris)
> - Add abstractions for call_rcu() and synchronize_rcu() (Danilo)
> - Add ECANCELED error code in Rust (Alice)
> - Remove the rcu_barrier() from FenceCtx::drop() – because we now use
> call_rcu(), there can be no UAF access to the FenceCtx anymore. In
> any case, it is illegal to use either call_rcu() or
> synchronize_rcu() in FenceCtx::drop(), because our new
> drop_driver_fence_data() can run in atomic context and might put the
> last fence_ctx reference.
> So we now only have to guard against module unload, which it seems
> either the driver or Rust driver-core / module unload infrastructure
> must solve.
> - Minor formatting etc. changes
> - Add C helpers to MAINTAINERS. (Danilo)
> - Ensure that `Fence::is_signaled()` is fully synchronized, i.e., all
> callbacks really have run. See [1] and [2]. (Myself, Christian
> König)
>
> Changes since the RFCs:
> - Include support for ForeignOwnable for ARef, so that a Fence can be
> stuffed into an XArray et al. (Code by Danilo)
> - Implement ForeignOwnable (with new borrow type) for DriverFence, so
> that it can be stuffed into an XArray.
> - Include the rcu::RcuBox data type to defer dropping data with RCU
> (Cody by Alice)
> - Port DmaFence to RcuBox to make UAF bugs through later, new dma_fence
> callbacks (backend_ops) impossible.
> - Force users to pass their fence data in an RcuBox (or have it not
> need drop()) through a Sealed trait.
> - Document the rules for the user's DriverFence::data's drop
> implementation very clearly (deadlock danger).
> - rustfmt, Clippy.
> - Various style suggestions, safety comments, etc. (Önur)
> - Add __rust_helper prefix to helper functions. (Önur)
>
> Changes in RFC v3:
> - Omit JobQueue patches for now
> - Completely redesign the memory layout: Instead of a Fence
> refcounting a DriverFence, both now live in the same allocation to
> allow for future support the dma_fence backend_ops callbacks which
> need to do container_of. (mostly Boris's feedback)
> - Allow for pre-allocating fences to avoid deadlocks when submitting
> jobs to a GPU. (Boris)
> - Simultaneously, allow for pre-preparing fence callback objects, so
> the driver can allocate them when it sees fit. (code largely stolen
> and inspired by Daniel).
> - Signal fences on drop, ensure synchronization.
> - Force users to set an error code when signalling.
> - Write more documentation
> - A ton of minor other changes.
>
>
> [1]
> https://lore.kernel.org/dri-devel/[email protected]/
> [2]
> https://lore.kernel.org/dri-devel/[email protected]/
>
>
> Alright, so since the last RFCs did not reveal significant design
> issues, I decided to transition this series to a v1 and hope that we can
> get it upstream.
>
> This now includes code for more common infrastructure that dma_fence
> needs, contributed by Danilo and Alice.
>
> ---
>
> Old cover letter for RFC:
>
> So, this is the spiritual successor of the first / second RFC [1]. v2
> also contained code for drm::JobQueue, but mostly to show how the fence
> code would be used. JobQueue is under heavy rework right now, so I don't
> want to bother your eyes with it. The docstring examples should show how
> Rust fences are supposed to be used, though.
>
> This v3 contains a huge amount of highly valuable feedback from a
> variety of people, notably Boris, but also from Alice, Gary and Danilo.
>
> There are some TODOs open (a better trait for fence backend_ops and RCU
> support), but my hope is that this effort is now finally approaching its
> end.
>
> I would greatly appreciate feedback and especially more information
> about what might be missing to make this usable, which is obviously
> where Daniel's and Boris's feedback will be valuable once more.
>
> Please regard this patch just as what it's titled: an RFC, to discuss a
> bit more and to inform a broader community about what the current state
> is and where this is heading at.
>
> Many regards,
> Philipp
>
> [1]
> https://lore.kernel.org/rust-for-linux/[email protected]/
>
> Danilo Krummrich (1):
> rust: types: implement ForeignOwnable for ARef<T>
>
> Philipp Stanner (4):
> rust: error: Add ECANCELED error code
> rust: sync: Add abstraction for rcu_barrier()
> rust: Add dma_fence abstractions
> MAINTAINERS: Add entry for Rust dma-buf
>
> MAINTAINERS | 5 +
> rust/bindings/bindings_helper.h | 1 +
> rust/helpers/dma_fence.c | 48 ++
> rust/helpers/helpers.c | 1 +
> rust/kernel/dma_buf/dma_fence.rs | 894 +++++++++++++++++++++++++++++++
> rust/kernel/dma_buf/mod.rs | 14 +
> rust/kernel/error.rs | 1 +
> rust/kernel/lib.rs | 1 +
> rust/kernel/sync/aref.rs | 40 ++
> rust/kernel/sync/rcu.rs | 20 +
> 10 files changed, 1025 insertions(+)
> create mode 100644 rust/helpers/dma_fence.c
> create mode 100644 rust/kernel/dma_buf/dma_fence.rs
> create mode 100644 rust/kernel/dma_buf/mod.rs
>
>
> base-commit: a73a398a68ca9b9e5116a617562471f16b8310c4
> --
> 2.54.0
>
This works on Tyr :)
For the whole series:
Tested-by: Daniel Almeida <[email protected]>
