Hi Matt,
Good morning!
Just a gentle follow-up on the remaining race issues in the |drm: Add
drm_work_fence helper| patch.
After applying the previous fixes in v9 [1], Sashiko found two remaining
race cases [2].
We are considering |schedule_work()| for the IRQ-context issue and an
atomic flag for the timing gap around |disable_work_sync()|.
Could you please let us know if these approaches look reasonable before
we prepare v10?
[1] v9 patch:
https://patchwork.freedesktop.org/patch/751979/?series=173582&rev=2
[2] Sashiko v9 review:
https://sashiko.dev/#/patchset/20260909044454.399340-1-srinivasan.shanmugam%40amd.com
We really appreciate all the time and effort you have put into reviewing
this serie.
Thanks again,
Srini
On 9/9/2026 10:14 AM, Srinivasan Shanmugam wrote:
This series extracts the dma-fence-callback-to-workqueue pattern shared
between XE and AMDGPU into common DRM helpers.
Patch 1 introduces drm_work_fence — a generic helper that queues a work
item when a dma-fence signals, for work that cannot run in IRQ context.
Patch 2 introduces drm_user_fence — extends drm_work_fence with
kthread_use_mm() support for drivers that need to write completion
status to userspace memory.
Patch 3 converts XE's open-coded xe_user_fence to use drm_user_fence.
Note: Patch 4 (per-signal compare functionality for AMDGPU's EOP
eventfd path) is deferred pending resolution of the compare address
read method (get_user() vs page-pinning), raised by Matthew Brost.
v9:
- Fix drm_work_fence_queue: drop ref if queue_work returns false,
closing the race between callback firing and queue_work() (Matt)
- Fix drm_work_fence_cancel_sync: use disable_work_sync() to close
the UAF race window between callback and queue_work() (Matt)
- Remove xe_sync_ufence_cancel_sync — no caller in this patch (Matt)
- Remove xe_sync_ufence_cancel from xe_vma_destroy_late — unnecessary
behaviour change; xe_ufence_worker only accesses device-level
resources, safe to run after VMA teardown (Matt)
v8:
- Fix copyright: The Linux Foundation → Advanced Micro Devices, Inc.
- Switch EXPORT_SYMBOL_GPL → EXPORT_SYMBOL for MIT-licensed code (Matt)
- Rename drm_work_fence_ops callback: writeback → worker (Matt)
- Rename drm_user_fence_ops callback: worker → writeback (Matt)
- Fix xe_ufence_worker ordering: WRITE_ONCE before copy_to_user,
add smp_wmb() before wake_up_all (Matt, confirmed via 8ae04fe9ffc93)
- Rename .worker → .writeback in xe_ufence_ops (Matt)
- Drop Patch 4 pending design decision on compare address read method
Suggested-by: Matthew Brost<[email protected]>
Suggested-by: Christian König<[email protected]>
Srinivasan Shanmugam (3):
drm: Add drm_work_fence helper
drm: Add drm_user_fence helper
drm/xe: Convert xe_user_fence to drm_user_fence
drivers/gpu/drm/Makefile | 2 +
drivers/gpu/drm/drm_user_fence.c | 70 +++++++++++
drivers/gpu/drm/drm_work_fence.c | 186 +++++++++++++++++++++++++++++
drivers/gpu/drm/xe/xe_sync.c | 141 +++++++++++-----------
drivers/gpu/drm/xe/xe_sync.h | 1 +
drivers/gpu/drm/xe/xe_sync_types.h | 1 -
include/drm/drm_user_fence.h | 123 +++++++++++++++++++
include/drm/drm_work_fence.h | 69 +++++++++++
8 files changed, 524 insertions(+), 69 deletions(-)
create mode 100644 drivers/gpu/drm/drm_user_fence.c
create mode 100644 drivers/gpu/drm/drm_work_fence.c
create mode 100644 include/drm/drm_user_fence.h
create mode 100644 include/drm/drm_work_fence.h
