Re: [PATCH v5 0/5] rust / dma_buf: Add abstractions for dma_fence

[Daniel Almeida <daniel.almeida@collabora.com>]

> On 3 Jul 2026, at 04:31, Philipp Stanner <phasta@kernel.org> wrote:
> 
> Changes since v4:
>  - Fix an uninitialized memory bug for FenceCbRegistration with
>    ManuallyDrop.
>  - Return FenceCtx as impl PinInit
>  - Make FenceCtx return an impl PinInit<T, Error> (Danilo)
>  - Reformat some comments
>  - Adjust the docu for rcu_barrier(), so that it matches the C side's
>    docu and our docu for rcu::synchronize_rcu().
> 
> Changes since v3:
>  - Add a FIXME for an encountered Rust compiler bug. (Gary)
>  - Add new Rust files also to DRM drivers & common infrastructure
>    MAINTAINERS file. (Danilo)
>  - Reposition ECANCELED error code. (Miguel)
>  - Replace refcounted FenceCtx in DriverFenceData with a reference plus
>    life time. (Boris)
>  - Re-add rcu_barrier() patch, since we now can use it for dropping the
>    fence context. (Danilo)
>  - Add forgotten R-b from Alice, and Acks for MAINTAINERS from
>    Christian and Sumit.
> 
> Changes since v2:
>  - Don't drop DriverFenceData as a whole, but only the members we
>    really want to drop. Gives more robustness. (Gary).
>  - Break apart large pin_init_from_closure(). (Danilo, Onur)
>  - Remove rcu_barrier() and synchronize_rcu() from FenceCtx::drop().
>    FenceCtx might drop in atomic context, where you must not perform
>    those operations. With the current way C dma_fence is designed, the
>    driver must wait for a grace period manually until it unloads.
>  - Repair the DriverFenceBorrow implementation, properly injecting a
>    life time into it. (Danilo)
>  - Fix memory layout bug for rcu_head. (Onur)
>  - Drop RCU patches, since this series doesn't need them anymore.
> 
> Changes since v1:
>  - Remove unnecessary mutable references (Alice)
>  - Split up unsafe comments where possible (Danilo)
>  - Remove PhantomData + implement FenceCtx ops trait (Boris)
>  - Consistently call FenceCtx generic data `T`. FenceDataType is
>    derived from that. (Boris)
>  - Add abstractions for call_rcu() and synchronize_rcu() (Danilo)
>  - Add ECANCELED error code in Rust (Alice)
>  - Remove the rcu_barrier() from FenceCtx::drop() – because we now use
>    call_rcu(), there can be no UAF access to the FenceCtx anymore. In
>    any case, it is illegal to use either call_rcu() or
>    synchronize_rcu() in FenceCtx::drop(), because our new
>    drop_driver_fence_data() can run in atomic context and might put the
>    last fence_ctx reference.
>    So we now only have to guard against module unload, which it seems
>    either the driver or Rust driver-core / module unload infrastructure
>    must solve.
>  - Minor formatting etc. changes
>  - Add C helpers to MAINTAINERS. (Danilo)
>  - Ensure that `Fence::is_signaled()` is fully synchronized, i.e., all
>    callbacks really have run. See [1] and [2]. (Myself, Christian
>    König)
> 
> Changes since the RFCs:
>  - Include support for ForeignOwnable for ARef, so that a Fence can be
>    stuffed into an XArray et al. (Code by Danilo)
>  - Implement ForeignOwnable (with new borrow type) for DriverFence, so
>    that it can be stuffed into an XArray.
>  - Include the rcu::RcuBox data type to defer dropping data with RCU
>    (Cody by Alice)
>  - Port DmaFence to RcuBox to make UAF bugs through later, new dma_fence
>    callbacks (backend_ops) impossible.
>  - Force users to pass their fence data in an RcuBox (or have it not
>    need drop()) through a Sealed trait.
>  - Document the rules for the user's DriverFence::data's drop
>    implementation very clearly (deadlock danger).
>  - rustfmt, Clippy.
>  - Various style suggestions, safety comments, etc. (Önur)
>  - Add __rust_helper prefix to helper functions. (Önur)
> 
> Changes in RFC v3:
>  - Omit JobQueue patches for now
>  - Completely redesign the memory layout: Instead of a Fence
>    refcounting a DriverFence, both now live in the same allocation to
>    allow for future support the dma_fence backend_ops callbacks which
>    need to do container_of. (mostly Boris's feedback)
>  - Allow for pre-allocating fences to avoid deadlocks when submitting
>    jobs to a GPU. (Boris)
>  - Simultaneously, allow for pre-preparing fence callback objects, so
>    the driver can allocate them when it sees fit. (code largely stolen
>    and inspired by Daniel).
>  - Signal fences on drop, ensure synchronization.
>  - Force users to set an error code when signalling.
>  - Write more documentation
>  - A ton of minor other changes.
> 
> 
> [1] https://lore.kernel.org/dri-devel/20260608142436.265820-2-phasta@kernel.org/
> [2] https://lore.kernel.org/dri-devel/20260612104251.2264707-2-phasta@kernel.org/
> 
> 
> Alright, so since the last RFCs did not reveal significant design
> issues, I decided to transition this series to a v1 and hope that we can
> get it upstream.
> 
> This now includes code for more common infrastructure that dma_fence
> needs, contributed by Danilo and Alice.
> 
> ---
> 
> Old cover letter for RFC:
> 
> So, this is the spiritual successor of the first / second RFC [1]. v2
> also contained code for drm::JobQueue, but mostly to show how the fence
> code would be used. JobQueue is under heavy rework right now, so I don't
> want to bother your eyes with it. The docstring examples should show how
> Rust fences are supposed to be used, though.
> 
> This v3 contains a huge amount of highly valuable feedback from a
> variety of people, notably Boris, but also from Alice, Gary and Danilo.
> 
> There are some TODOs open (a better trait for fence backend_ops and RCU
> support), but my hope is that this effort is now finally approaching its
> end.
> 
> I would greatly appreciate feedback and especially more information
> about what might be missing to make this usable, which is obviously
> where Daniel's and Boris's feedback will be valuable once more.
> 
> Please regard this patch just as what it's titled: an RFC, to discuss a
> bit more and to inform a broader community about what the current state
> is and where this is heading at.
> 
> Many regards,
> Philipp
> 
> [1] https://lore.kernel.org/rust-for-linux/20260203081403.68733-2-phasta@kernel.org/
> 
> Danilo Krummrich (1):
>  rust: types: implement ForeignOwnable for ARef<T>
> 
> Philipp Stanner (4):
>  rust: error: Add ECANCELED error code
>  rust: sync: Add abstraction for rcu_barrier()
>  rust: Add dma_fence abstractions
>  MAINTAINERS: Add entry for Rust dma-buf
> 
> MAINTAINERS                      |   5 +
> rust/bindings/bindings_helper.h  |   1 +
> rust/helpers/dma_fence.c         |  48 ++
> rust/helpers/helpers.c           |   1 +
> rust/kernel/dma_buf/dma_fence.rs | 894 +++++++++++++++++++++++++++++++
> rust/kernel/dma_buf/mod.rs       |  14 +
> rust/kernel/error.rs             |   1 +
> rust/kernel/lib.rs               |   1 +
> rust/kernel/sync/aref.rs         |  40 ++
> rust/kernel/sync/rcu.rs          |  20 +
> 10 files changed, 1025 insertions(+)
> create mode 100644 rust/helpers/dma_fence.c
> create mode 100644 rust/kernel/dma_buf/dma_fence.rs
> create mode 100644 rust/kernel/dma_buf/mod.rs
> 
> 
> base-commit: a73a398a68ca9b9e5116a617562471f16b8310c4
> -- 
> 2.54.0
> 

This works on Tyr :)

For the whole series:

Tested-by: Daniel Almeida <daniel.almeida@collabora.com>