Re: [PATCH v9 0/3] drm: Extract dma-fence-to-workqueue pattern into common helpers

[SRINIVASAN SHANMUGAM <srinivasan.shanmugam@amd.com>]

[-- Attachment #1: Type: text/plain, Size: 3641 bytes --]

Hi Matt,

Good morning!

Just a gentle follow-up on the remaining race issues in the |drm: Add 
drm_work_fence helper| patch.

After applying the previous fixes in v9 [1], Sashiko found two remaining 
race cases [2].

We are considering |schedule_work()| for the IRQ-context issue and an 
atomic flag for the timing gap around |disable_work_sync()|.

Could you please let us know if these approaches look reasonable before 
we prepare v10?

[1] v9 patch:
https://patchwork.freedesktop.org/patch/751979/?series=173582&rev=2

[2] Sashiko v9 review:
https://sashiko.dev/#/patchset/20260909044454.399340-1-srinivasan.shanmugam%40amd.com

We really appreciate all the time and effort you have put into reviewing 
this serie.

Thanks again,
Srini

On 9/9/2026 10:14 AM, Srinivasan Shanmugam wrote:

> This series extracts the dma-fence-callback-to-workqueue pattern shared
> between XE and AMDGPU into common DRM helpers.
>
> Patch 1 introduces drm_work_fence — a generic helper that queues a work
> item when a dma-fence signals, for work that cannot run in IRQ context.
>
> Patch 2 introduces drm_user_fence — extends drm_work_fence with
> kthread_use_mm() support for drivers that need to write completion
> status to userspace memory.
>
> Patch 3 converts XE's open-coded xe_user_fence to use drm_user_fence.
>
> Note: Patch 4 (per-signal compare functionality for AMDGPU's EOP
> eventfd path) is deferred pending resolution of the compare address
> read method (get_user() vs page-pinning), raised by Matthew Brost.
>
> v9:
> - Fix drm_work_fence_queue: drop ref if queue_work returns false,
>    closing the race between callback firing and queue_work() (Matt)
> - Fix drm_work_fence_cancel_sync: use disable_work_sync() to close
>    the UAF race window between callback and queue_work() (Matt)
> - Remove xe_sync_ufence_cancel_sync — no caller in this patch (Matt)
> - Remove xe_sync_ufence_cancel from xe_vma_destroy_late — unnecessary
>    behaviour change; xe_ufence_worker only accesses device-level
>    resources, safe to run after VMA teardown (Matt)
>
> v8:
> - Fix copyright: The Linux Foundation → Advanced Micro Devices, Inc.
> - Switch EXPORT_SYMBOL_GPL → EXPORT_SYMBOL for MIT-licensed code (Matt)
> - Rename drm_work_fence_ops callback: writeback → worker (Matt)
> - Rename drm_user_fence_ops callback: worker → writeback (Matt)
> - Fix xe_ufence_worker ordering: WRITE_ONCE before copy_to_user,
>    add smp_wmb() before wake_up_all (Matt, confirmed via 8ae04fe9ffc93)
> - Rename .worker → .writeback in xe_ufence_ops (Matt)
> - Drop Patch 4 pending design decision on compare address read method
>
> Suggested-by: Matthew Brost<matthew.brost@intel.com>
> Suggested-by: Christian König<christian.koenig@amd.com>
>
> Srinivasan Shanmugam (3):
>    drm: Add drm_work_fence helper
>    drm: Add drm_user_fence helper
>    drm/xe: Convert xe_user_fence to drm_user_fence
>
>   drivers/gpu/drm/Makefile           |   2 +
>   drivers/gpu/drm/drm_user_fence.c   |  70 +++++++++++
>   drivers/gpu/drm/drm_work_fence.c   | 186 +++++++++++++++++++++++++++++
>   drivers/gpu/drm/xe/xe_sync.c       | 141 +++++++++++-----------
>   drivers/gpu/drm/xe/xe_sync.h       |   1 +
>   drivers/gpu/drm/xe/xe_sync_types.h |   1 -
>   include/drm/drm_user_fence.h       | 123 +++++++++++++++++++
>   include/drm/drm_work_fence.h       |  69 +++++++++++
>   8 files changed, 524 insertions(+), 69 deletions(-)
>   create mode 100644 drivers/gpu/drm/drm_user_fence.c
>   create mode 100644 drivers/gpu/drm/drm_work_fence.c
>   create mode 100644 include/drm/drm_user_fence.h
>   create mode 100644 include/drm/drm_work_fence.h
>

[-- Attachment #2: Type: text/html, Size: 40561 bytes --]