From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2300E1F5437; Sat, 20 Jun 2026 18:49:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781981377; cv=none; b=k3pCBbUCXnKYbKrrOaBg3hbZMoY2l+KQhsFtvhUK3Wk2Pq6be0i1Ij9HwZGLwY/PlQxTdtq8+tRE43Rv+svVzyAtEcJbNMqFNXablzyB4rhFS6LxWOKTZKZQH3Tqul/lEn/63Th7ZvjgvKXdaSPUsVVnByVF5ltQE0IphQcwyug= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781981377; c=relaxed/simple; bh=oXhS3QHhSpoSqqxaozVMMcG6d5hMtBO0Fr18DnnP0sY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=t8aNOXUYwN8qLVyGGJV3rx+sW8OVRg5QkSgJiBwtnnCtLsR5ucPXXVPSSaOyDgD8zn1JRg4xudKHwKFLIFSYcIT7dEP32rJ0p8DLSEKcefojlDkoaI0WzctxvEpNyXIFfGtPIbkCwScCtPvZ5+6frpu93DKc6L6mv1jADVhgQxk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LUgOgMCJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LUgOgMCJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 95EA11F000E9; Sat, 20 Jun 2026 18:49:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781981375; bh=hn9G1znYb+a9sJ9JfqvKyzoUCkNcuNUh7aU3e3ImFtk=; h=From:To:Cc:Subject:Date; b=LUgOgMCJMYlR9SFcndiL9sErWv3HUs7gN/BzJZZ+CHVLSjNdIMeHz2dT0UiTserOQ 1Zv0M3fQR0/n5MQTGwQKdiMVsS9bH+ETst2n1bLIan8YzuHaP31QUC4KKPnhcJcJmr VEImjMzC8Og+lR9kHtSHv6b8xLFMw2c0lNu73kcRkPIsUMNkSohNrdzSDVm2wiJYDy b+EXJbnFzdyrAvaJhwAb0yYXj6X7qg/jjkwvO2kFx8W26EcmIiz6mCvgFvR3Rag7aB UevzSqWOLeIn+J6WLBCXxn2Q38sTDKV0NmfLzGTu5nL8sAEuzbTvY2CeagDhEbCtkW U0Es+0GX06lqA== From: Danilo Krummrich To: dakr@kernel.org, aliceryhl@google.com, daniel.almeida@collabora.com, acourbot@nvidia.com, ecourtney@nvidia.com, ojeda@kernel.org, boqun@kernel.org, gary@garyguo.net, bjorn3_gh@protonmail.com, lossin@kernel.org, a.hindborg@kernel.org, tmgross@umich.edu, deborah.brouwer@collabora.com, boris.brezillon@collabora.com, lyude@redhat.com Cc: driver-core@lists.linux.dev, linux-kernel@vger.kernel.org, nova-gpu@lists.linux.dev, dri-devel@lists.freedesktop.org, rust-for-linux@vger.kernel.org Subject: [PATCH v4 00/16] rust: drm: Higher-Ranked Lifetime private data Date: Sat, 20 Jun 2026 20:47:53 +0200 Message-ID: <20260620184924.2247517-1-dakr@kernel.org> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: rust-for-linux@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit DRM ioctls run in process context without any guarantee that the parent bus device is still bound. This series solves the problem by introducing RegistrationGuard -- a guard representing a drm_dev_enter/exit SRCU critical section that proves the parent bus device is bound for the lifetime of the guard. As initial plumbing for this, the DRM DeviceContext typestates are reworked: Uninit is renamed to Normal, defaults are adjusted, AlwaysRefCounted is restricted to Normal, and a Deref chain from Device to Device is established. This gives Device the semantic that the device is currently registered and the parent bus device is bound, which makes the RegistrationGuard and ioctl dispatch much cleaner. An Ioctl context restricts registration_guard() to ioctl dispatch, where the DRM core guarantees prior registration. On top of that, add RegistrationData as a ForLt associated type on drm::Driver, allowing drivers to store data whose lifetime is tied to the parent bus device binding scope. The data is allocated in Registration::new(), lifetime-erased to 'static for storage, and made accessible through Device::registration_data_with(). The closure's HRTB ties the lifetime to the closure scope; internally the 'static pointer is cast back to the closure-scoped lifetime. The reference is valid for the duration of the drm_dev_enter/exit critical section held by RegistrationGuard. Also update the ioctl dispatch macro to wrap every handler in a RegistrationGuard, returning ENODEV if the device has been unplugged, and pass the registration data to handlers. This series is based on [1]; a branch with all patches can be found in [2]. [1] https://lore.kernel.org/driver-core/20260618230834.812007-1-dakr@kernel.org/ [2] https://git.kernel.org/pub/scm/linux/kernel/git/dakr/linux.git/log/?h=drm-lifetime Changes in v4: - Fix pre-existing unbounded lifetimes in ioctl handler arguments. - Fix registration_guard() being callable on unregistered devices by introducing an Ioctl device context typestate; registration_guard() is now only available on Device, which is exclusively constructed in ioctl dispatch context where the DRM core guarantees prior registration. - Fix type inference allowing handlers to obtain Device before RegistrationGuard is acquired. - Make RegistrationGuard !Send via NotThreadSafe to prevent potential lockdep splats from cross-thread SRCU unlock. - Store &Device directly in RegistrationGuard instead of calling assume_ctx() in Deref. Changes in v3: - Rename UnbindGuard to RegistrationGuard - RegistrationGuard no longer dereferences to &Device; it dereferences to &drm::Device instead - Drop Registration::new() and rename Registration::new_with_lt() to Registration::new() - Rework DeviceContext typestates: rename Uninit to Normal, restrict AlwaysRefCounted to Normal, establish Deref chain from Registered to Normal - Add AsRef> on Device for parent device access - Move registration_data_with() from RegistrationGuard to drm::Device - Ioctl handlers no longer receive &Device, only registration data and drm::Device - Use Device::as_ref() to access parent device in nova-drm Changes in v2: - Replace unsafe direct registration data access in ioctl dispatch with safe UnbindGuard::registration_data_with() closure - Eliminate unbind_guard() free function; use type-inference anchor to enable direct dev.unbind_guard() method call in the ioctl macro - UnbindGuard::registration_data_with() provides both parent device and registration data to the closure - Add nova-drm conversion patch demonstrating lifetime-aware registration data with &'bound auxiliary::Device - Various safety comment and documentation improvements Danilo Krummrich (16): rust: drm: ioctl: fix unbounded lifetimes in ioctl handler arguments rust: drm: rename Uninit DeviceContext to Normal rust: drm: Add Driver::ParentDevice associated type rust: drm: change default DeviceContext to Normal rust: drm: restrict AlwaysRefCounted to Normal Device context rust: drm: restrict AlwaysRefCounted to Normal GEM Object context rust: drm: split Deref for Device context typestates rust: drm: pin ioctl Device reference to Normal context rust: drm: add Ioctl device context typestate rust: drm: Add RegistrationGuard for drm_dev_enter/exit critical sections rust: drm: Wrap ioctl dispatch in RegistrationGuard rust: drm: return ParentDevice from Device AsRef rust: drm: add AsRef> for Device rust: drm: Add RegistrationData to drm::Driver rust: drm: Pass registration data to ioctl handlers drm: nova: Use drm::Device to access the parent bus device drivers/gpu/drm/nova/driver.rs | 41 +++-- drivers/gpu/drm/nova/file.rs | 22 ++- drivers/gpu/drm/nova/gem.rs | 18 +- drivers/gpu/drm/tyr/driver.rs | 28 ++-- drivers/gpu/drm/tyr/file.rs | 8 +- drivers/gpu/drm/tyr/gem.rs | 11 +- rust/kernel/drm/device.rs | 293 ++++++++++++++++++++++++--------- rust/kernel/drm/driver.rs | 123 +++++++++----- rust/kernel/drm/gem/mod.rs | 98 ++++++----- rust/kernel/drm/gem/shmem.rs | 79 ++++----- rust/kernel/drm/ioctl.rs | 108 ++++++++++-- rust/kernel/drm/mod.rs | 4 +- 12 files changed, 550 insertions(+), 283 deletions(-) base-commit: 9ece8b7075e983bc01223a4aa1eb1c99285f83ad -- 2.54.0