From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 30A6BCD6E56 for ; Mon, 1 Jun 2026 12:48:02 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 8E05E10E7A9; Mon, 1 Jun 2026 12:48:01 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; secure) header.d=mailbox.org header.i=@mailbox.org header.b="JG6hvLtd"; dkim-atps=neutral Received: from mout-p-101.mailbox.org (mout-p-101.mailbox.org [80.241.56.151]) by gabe.freedesktop.org (Postfix) with ESMTPS id 5776010E7A9 for ; Mon, 1 Jun 2026 12:47:53 +0000 (UTC) Received: from smtp202.mailbox.org (smtp202.mailbox.org [10.196.197.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mout-p-101.mailbox.org (Postfix) with ESMTPS id 4gTYdx5kN3z9svK; Mon, 1 Jun 2026 14:47:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailbox.org; s=mail20150812; t=1780318069; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=5YOffrb6TuISTmHSo0qRYfjsVC3kJaH+9CwYeMAL1Oc=; b=JG6hvLtdgAJuiXUOzLhugnRCckVKHn4IG120YlvzT92cVxFT5/AynE7XGq4r1kGzAAE8mq SJVoCZJ/wt05vCn324jWIGjDg6Xs32LVjBKk+scs4B1Rv2UXckNg/ZBgUNK2JsrQz9XpFo nhYaeXhmvi7qhCjAcNx+nQFXm4DnmJr5mfbyhiZ06oaK2RTSPliLhsvH66i8ba8DJahHo+ 5xXrVvEZogcNtJRjwmVq9Qd1FKhKI/ZxBo3ZIiDQLGOkskEfse3i7Q99dTCQYJ3aHguTtE FzDxZeXbI8StRbe6a5MXWLP//c+SgmyEO9imq7DCxco4h0IaCTbpD7iQwZKmhg== Message-ID: <3b216f24afb406b797b8bbb73b3f5c0eec2fdc6c.camel@mailbox.org> Subject: Re: [PATCH 3/4] rust: Add dma_fence abstractions From: Philipp Stanner To: Alice Ryhl , phasta@kernel.org Cc: Miguel Ojeda , Boqun Feng , Gary Guo , =?ISO-8859-1?Q?Bj=F6rn?= Roy Baron , Benno Lossin , Andreas Hindborg , Trevor Gross , Danilo Krummrich , Sumit Semwal , Christian =?ISO-8859-1?Q?K=F6nig?= , "Paul E. McKenney" , Frederic Weisbecker , Neeraj Upadhyay , Joel Fernandes , Josh Triplett , Uladzislau Rezki , Steven Rostedt , Mathieu Desnoyers , Lai Jiangshan , Zqiang , Daniel Almeida , Greg Kroah-Hartman , Igor Korotin , Lorenzo Stoakes , Alexandre Courbot , FUJITA Tomonori , Krishna Ketan Rai , Shankari Anand , manos@pitsidianak.is, Boris Brezillon , linux-kernel@vger.kernel.org, rust-for-linux@vger.kernel.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, rcu@vger.kernel.org Date: Mon, 01 Jun 2026 14:47:37 +0200 In-Reply-To: References: <20260530143541.229628-2-phasta@kernel.org> <20260530143541.229628-5-phasta@kernel.org> <0ea6b6fdd1e3f1e07445f17c0bf672524938dc85.camel@mailbox.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-MBO-RS-META: bspshuqdn1yjkm5ampzssxemt6wdpphn X-MBO-RS-ID: 3aa08b834777349d892 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: phasta@kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Mon, 2026-06-01 at 12:39 +0000, Alice Ryhl wrote: > On Mon, Jun 01, 2026 at 02:26:17PM +0200, Philipp Stanner wrote: > > On Mon, 2026-06-01 at 10:36 +0000, Alice Ryhl wrote: > > > On Sat, May 30, 2026 at 04:35:11PM +0200, Philipp Stanner wrote: > > > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 unsafe { > > > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= bindings::dma_fence_remove_callback(self.fence.as_raw(), self.cb.get()); > > > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 } > > >=20 > > > Formatting nit: Usually the ; goes outside the unsafe block. > >=20 > > I could have sworn that it was rustfmt who did that? Maybe because the > > ; was inside to begin with. >=20 > Indeed, rustfmt will not change whether the ; is inside or outside the > unsafe block. >=20 > > > > +/// A trait to enforce that all data in a [`DriverFence`] either d= oes not need > > > > +/// drop, or lives in a [`RcuBox`]. > > > > +pub trait DriverFenceAllowedData: private::Sealed {} > > > > + > > > > +mod private { > > > > +=C2=A0=C2=A0=C2=A0 pub trait Sealed {} > > > > +} > > > > + > > > > +impl DriverFenceAllowedData for F {} > > > > +impl DriverFenceAllowedData for RcuBox {} > > > > + > > > > +impl private::Sealed for F {} > > > > +impl private::Sealed for RcuBox {} > > >=20 > > > Why sealed? Just make the trait unsafe and require the things you > > > require from the user. > >=20 > > This is far better. We definitely only allow the user to pass A or B, > > and only then it compiles. >=20 > What if I have another type that I want to use here? For example, maybe > I have a struct containing a copy field and an RcuBox. Or maybe I have > an ARef<_> of some C type that uses rcu for cleanup. Then I must edit > this file to add support for it? >=20 > > The unsafe implementation could be messed up. > >=20 > > I thought that's what Sealed is for. Or isn't it? >=20 > Sealed is for making 100% sure that downstream crates/drivers cannot > provide their own implementations. But I don't see why you need that. > All you require is that the value remains valid for one grace period > after cleanup begins. As long as the type satisfies that, you are happy. > An unsafe trait can require that sort of requirement from the user. >=20 > I think what you want is expressed well by `RcuFreeSafe` from this > thread: > https://rust-for-linux.zulipchat.com/#narrow/channel/291566-Library/topic= /Consolidate.20.60PollCondVarBox.60.20into.20.60Rcu.2ABox.60/near/598726724 >=20 I guess this is a question of design principles. If you demand an RcuBox, you have a guarantee that it's safe. If you demand an unsafe trait, you open the possibility for people messing up. Due to the unsafe-contract you'd have moved the responsibility for the soundness to the driver. I would not want to block your suggestion, but I am not sure whether that's really the better design idea. > > >=20 P.