[RFC PATCH 0/6] dma-buf: Phase out is_signaled() race

[RFC PATCH 0/6] dma-buf: Phase out is_signaled() race

[Philipp Stanner]

dma_fence_is_signaled() can return true *while* the fence is signaling.
This has caused explosions before and I guess we can agree that it's
just not ideal.

The fundamental issue is that the fence-signaled-bit is set under lock
protection but read without it.

So ideally, we would read it with the lock. This would not change the
relative order, i.e. the bit would still be true in the fence callbacks.

Christian informs us that taking the lock causes people to complain
about performance regressions because the lock-taking shoots down copied
cache-lines. (which is weird since it would mean that someone is
repeatedly polling on fences instead of just registering a callback to
notify himself once it signals)

Let's accept the potential for regressions as true for now.
Nevertheless, I think I can propose a path towards removing the race:

This series suggests taking the lock in dma_fence_is_signaled() *unless*
the driver explicitly asks for a check with a race-condition.

As a preparation, I allow drivers to set flags when initializing fences.
Then, we add a flag with which the driver can switch locking off for
that particular function.

By default, we let all drivers take the lock.

Should we then, in the kernel release process get reports about
regressions, we can set the race-flag for the affected driver and
restore the old behavior.

Should there be no reports, we could phase the flag out again after a
few releases, always taking the lock.

New users would always see the lock.

I put all potentially affected parties on Cc. Please point out if you
can already foresee your driver being negatively affected by this.

P.


Philipp Stanner (6):
  dma-buf: dma-fence: Add flags parameter to dma_fence_init()
  dma-buf: dma-fence: Add flag for using 64-bit seqnos
  dma-buf: Port users of dma_fence_init64()
  dma-buf: dma-fence: remove dma_fence_init64()
  dma-buf: dma-fence: Close race in dma_fence_is_signaled() by default
  drm/nouveau: Remove hacky fence check

 drivers/accel/amdxdna/amdxdna_ctx.c           |  2 +-
 drivers/accel/ethosu/ethosu_job.c             |  2 +-
 drivers/accel/ivpu/ivpu_job.c                 |  2 +-
 drivers/accel/rocket/rocket_job.c             |  2 +-
 drivers/dma-buf/dma-fence-array.c             |  2 +-
 drivers/dma-buf/dma-fence-chain.c             |  4 +-
 drivers/dma-buf/dma-fence.c                   | 44 +++++------------
 drivers/dma-buf/st-dma-fence-chain.c          |  2 +-
 drivers/dma-buf/st-dma-fence-unwrap.c         |  2 +-
 drivers/dma-buf/st-dma-fence.c                |  2 +-
 drivers/dma-buf/st-dma-resv.c                 |  2 +-
 drivers/dma-buf/sw_sync.c                     |  2 +-
 .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c  |  2 +-
 .../drm/amd/amdgpu/amdgpu_eviction_fence.c    |  7 +--
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c     |  2 +-
 .../gpu/drm/amd/amdgpu/amdgpu_userq_fence.c   |  5 +-
 .../gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c  |  5 +-
 drivers/gpu/drm/drm_crtc.c                    |  2 +-
 drivers/gpu/drm/drm_writeback.c               |  2 +-
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c         |  2 +-
 drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c  |  2 +-
 drivers/gpu/drm/i915/i915_request.c           |  2 +-
 drivers/gpu/drm/i915/i915_sw_fence_work.c     |  2 +-
 drivers/gpu/drm/i915/i915_vma_resource.c      |  2 +-
 .../gpu/drm/i915/selftests/i915_sw_fence.c    |  2 +-
 drivers/gpu/drm/imagination/pvr_ccb.c         |  2 +-
 drivers/gpu/drm/imagination/pvr_queue.c       |  2 +-
 drivers/gpu/drm/lima/lima_sched.c             |  2 +-
 drivers/gpu/drm/msm/msm_fence.c               |  2 +-
 drivers/gpu/drm/nouveau/nouveau_drm.c         | 13 -----
 drivers/gpu/drm/nouveau/nouveau_fence.c       |  4 +-
 drivers/gpu/drm/panfrost/panfrost_job.c       |  2 +-
 drivers/gpu/drm/panthor/panthor_sched.c       |  2 +-
 drivers/gpu/drm/qxl/qxl_release.c             |  2 +-
 drivers/gpu/drm/radeon/radeon_fence.c         |  2 +-
 drivers/gpu/drm/scheduler/sched_fence.c       |  4 +-
 .../gpu/drm/scheduler/tests/mock_scheduler.c  |  2 +-
 drivers/gpu/drm/ttm/tests/ttm_bo_test.c       |  2 +-
 .../gpu/drm/ttm/tests/ttm_bo_validate_test.c  |  2 +-
 drivers/gpu/drm/v3d/v3d_fence.c               |  2 +-
 drivers/gpu/drm/vc4/vc4_gem.c                 |  2 +-
 drivers/gpu/drm/vgem/vgem_fence.c             |  2 +-
 drivers/gpu/drm/virtio/virtgpu_fence.c        |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c         |  2 +-
 drivers/gpu/drm/xe/xe_hw_fence.c              |  2 +-
 drivers/gpu/drm/xe/xe_oa.c                    |  2 +-
 drivers/gpu/drm/xe/xe_preempt_fence.c         |  2 +-
 drivers/gpu/drm/xe/xe_tlb_inval.c             |  2 +-
 drivers/gpu/host1x/fence.c                    |  2 +-
 drivers/iio/industrialio-buffer.c             |  2 +-
 drivers/usb/gadget/function/f_fs.c            |  2 +-
 include/linux/dma-fence.h                     | 48 +++++++++++++++++--
 52 files changed, 115 insertions(+), 105 deletions(-)

-- 
2.56.0

[RFC PATCH 1/6] dma-buf: dma-fence: Add flags parameter to dma_fence_init()

[Philipp Stanner]

Currently, there are two init functions for dma_fence, dma_fence_init()
and dma_fence_init64().

Since more future user options for dma_fence initialization would
require distinct init functions, too, it is better to do this in a
unified way.

To prepare for that, add a flags field to dma_fence_init(). Adjust all
affected drivers, preserving the old behavior.

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/accel/amdxdna/amdxdna_ctx.c           |  2 +-
 drivers/accel/ethosu/ethosu_job.c             |  2 +-
 drivers/accel/ivpu/ivpu_job.c                 |  2 +-
 drivers/accel/rocket/rocket_job.c             |  2 +-
 drivers/dma-buf/dma-fence-array.c             |  2 +-
 drivers/dma-buf/dma-fence.c                   |  9 ++++----
 drivers/dma-buf/st-dma-fence-chain.c          |  2 +-
 drivers/dma-buf/st-dma-fence-unwrap.c         |  2 +-
 drivers/dma-buf/st-dma-fence.c                |  2 +-
 drivers/dma-buf/st-dma-resv.c                 |  2 +-
 drivers/dma-buf/sw_sync.c                     |  2 +-
 .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c  |  2 +-
 drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c     |  2 +-
 drivers/gpu/drm/drm_crtc.c                    |  2 +-
 drivers/gpu/drm/drm_writeback.c               |  2 +-
 drivers/gpu/drm/etnaviv/etnaviv_gpu.c         |  2 +-
 drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c  |  2 +-
 drivers/gpu/drm/i915/i915_request.c           |  2 +-
 drivers/gpu/drm/i915/i915_sw_fence_work.c     |  2 +-
 drivers/gpu/drm/i915/i915_vma_resource.c      |  2 +-
 .../gpu/drm/i915/selftests/i915_sw_fence.c    |  2 +-
 drivers/gpu/drm/imagination/pvr_ccb.c         |  2 +-
 drivers/gpu/drm/imagination/pvr_queue.c       |  2 +-
 drivers/gpu/drm/lima/lima_sched.c             |  2 +-
 drivers/gpu/drm/msm/msm_fence.c               |  2 +-
 drivers/gpu/drm/nouveau/nouveau_fence.c       |  4 ++--
 drivers/gpu/drm/panfrost/panfrost_job.c       |  2 +-
 drivers/gpu/drm/panthor/panthor_sched.c       |  2 +-
 drivers/gpu/drm/qxl/qxl_release.c             |  2 +-
 drivers/gpu/drm/radeon/radeon_fence.c         |  2 +-
 drivers/gpu/drm/scheduler/sched_fence.c       |  4 ++--
 .../gpu/drm/scheduler/tests/mock_scheduler.c  |  2 +-
 drivers/gpu/drm/ttm/tests/ttm_bo_test.c       |  2 +-
 .../gpu/drm/ttm/tests/ttm_bo_validate_test.c  |  2 +-
 drivers/gpu/drm/v3d/v3d_fence.c               |  2 +-
 drivers/gpu/drm/vc4/vc4_gem.c                 |  2 +-
 drivers/gpu/drm/vgem/vgem_fence.c             |  2 +-
 drivers/gpu/drm/virtio/virtgpu_fence.c        |  2 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c         |  2 +-
 drivers/gpu/drm/xe/xe_hw_fence.c              |  2 +-
 drivers/gpu/drm/xe/xe_oa.c                    |  2 +-
 drivers/gpu/drm/xe/xe_preempt_fence.c         |  2 +-
 drivers/gpu/drm/xe/xe_tlb_inval.c             |  2 +-
 drivers/gpu/host1x/fence.c                    |  2 +-
 drivers/iio/industrialio-buffer.c             |  2 +-
 drivers/usb/gadget/function/f_fs.c            |  2 +-
 include/linux/dma-fence.h                     | 22 ++++++++++++++++---
 47 files changed, 71 insertions(+), 54 deletions(-)

diff --git a/drivers/accel/amdxdna/amdxdna_ctx.c b/drivers/accel/amdxdna/amdxdna_ctx.c
index f4004630dc1b..f2245541f1ee 100644
--- a/drivers/accel/amdxdna/amdxdna_ctx.c
+++ b/drivers/accel/amdxdna/amdxdna_ctx.c
@@ -53,7 +53,7 @@ static struct dma_fence *amdxdna_fence_create(struct amdxdna_hwctx *hwctx)
 
 	spin_lock_init(&fence->lock);
 	/* Unique timeline context prevents eviction from shared BO reservation. */
-	dma_fence_init(&fence->base, &fence_ops, &fence->lock, dma_fence_context_alloc(1), 0);
+	dma_fence_init(&fence->base, &fence_ops, &fence->lock, dma_fence_context_alloc(1), 0, 0);
 	return &fence->base;
 }
 
diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c
index d656b3ec670e..d4fc71436cae 100644
--- a/drivers/accel/ethosu/ethosu_job.c
+++ b/drivers/accel/ethosu/ethosu_job.c
@@ -219,7 +219,7 @@ static struct dma_fence *ethosu_job_run(struct drm_sched_job *sched_job)
 		return NULL;
 
 	dma_fence_init(fence, &ethosu_fence_ops, &dev->fence_lock,
-		       dev->fence_context, ++dev->emit_seqno);
+		       dev->fence_context, ++dev->emit_seqno, 0);
 	dma_fence_get(fence);
 
 	ethosu_switch_perfmon(dev, job);
diff --git a/drivers/accel/ivpu/ivpu_job.c b/drivers/accel/ivpu/ivpu_job.c
index 6a1307ee2e19..ca24e84a2ed9 100644
--- a/drivers/accel/ivpu/ivpu_job.c
+++ b/drivers/accel/ivpu/ivpu_job.c
@@ -519,7 +519,7 @@ static struct dma_fence *ivpu_fence_create(struct ivpu_device *vdev)
 
 	fence->vdev = vdev;
 	spin_lock_init(&fence->lock);
-	dma_fence_init(&fence->base, &ivpu_fence_ops, &fence->lock, dma_fence_context_alloc(1), 1);
+	dma_fence_init(&fence->base, &ivpu_fence_ops, &fence->lock, dma_fence_context_alloc(1), 1, 0);
 
 	return &fence->base;
 }
diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
index ce994748dd5d..4526c28326bb 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -61,7 +61,7 @@ static struct dma_fence *rocket_fence_create(struct rocket_core *core)
 		return ERR_PTR(-ENOMEM);
 
 	dma_fence_init(fence, &rocket_fence_ops, &core->fence_lock,
-		       core->fence_context, ++core->emit_seqno);
+		       core->fence_context, ++core->emit_seqno, 0);
 
 	return fence;
 }
diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c
index 5e10e8df372f..e2dddbfddea2 100644
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -205,7 +205,7 @@ void dma_fence_array_init(struct dma_fence_array *array,
 	array->num_fences = num_fences;
 
 	dma_fence_init(&array->base, &dma_fence_array_ops, NULL, context,
-		       seqno);
+		       seqno, 0);
 	init_irq_work(&array->work, irq_dma_fence_array_work);
 
 	/*
diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index bd58688b81a7..a640fb99f942 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -122,7 +122,7 @@ static const struct dma_fence_ops dma_fence_stub_ops = {
 
 static int __init dma_fence_init_stub(void)
 {
-	dma_fence_init(&dma_fence_stub, &dma_fence_stub_ops, NULL, 0, 0);
+	dma_fence_init(&dma_fence_stub, &dma_fence_stub_ops, NULL, 0, 0, 0);
 	set_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
 		&dma_fence_stub.flags);
 	dma_fence_signal(&dma_fence_stub);
@@ -156,7 +156,7 @@ struct dma_fence *dma_fence_allocate_private_stub(ktime_t timestamp)
 	if (fence == NULL)
 		return NULL;
 
-	dma_fence_init(fence, &dma_fence_stub_ops, NULL, 0, 0);
+	dma_fence_init(fence, &dma_fence_stub_ops, NULL, 0, 0, 0);
 	set_bit(DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
 		&fence->flags);
 
@@ -1111,9 +1111,10 @@ __dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
  */
 void
 dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
-	       spinlock_t *lock, u64 context, u64 seqno)
+	       spinlock_t *lock, u64 context, u64 seqno,
+	       unsigned long init_flags)
 {
-	__dma_fence_init(fence, ops, lock, context, seqno, 0UL);
+	__dma_fence_init(fence, ops, lock, context, seqno, 0);
 }
 EXPORT_SYMBOL(dma_fence_init);
 
diff --git a/drivers/dma-buf/st-dma-fence-chain.c b/drivers/dma-buf/st-dma-fence-chain.c
index e0d9b69bfa76..b9610df3ff19 100644
--- a/drivers/dma-buf/st-dma-fence-chain.c
+++ b/drivers/dma-buf/st-dma-fence-chain.c
@@ -52,7 +52,7 @@ static struct dma_fence *mock_fence(void)
 		return NULL;
 
 	spin_lock_init(&f->lock);
-	dma_fence_init(&f->base, &mock_ops, &f->lock, 0, 0);
+	dma_fence_init(&f->base, &mock_ops, &f->lock, 0, 0, 0);
 
 	return &f->base;
 }
diff --git a/drivers/dma-buf/st-dma-fence-unwrap.c b/drivers/dma-buf/st-dma-fence-unwrap.c
index c5353b36f0e4..dbebc3046d42 100644
--- a/drivers/dma-buf/st-dma-fence-unwrap.c
+++ b/drivers/dma-buf/st-dma-fence-unwrap.c
@@ -36,7 +36,7 @@ static struct dma_fence *__mock_fence(u64 context, u64 seqno)
 		return NULL;
 
 	spin_lock_init(&f->lock);
-	dma_fence_init(&f->base, &mock_ops, &f->lock, context, seqno);
+	dma_fence_init(&f->base, &mock_ops, &f->lock, context, seqno, 0);
 
 	return &f->base;
 }
diff --git a/drivers/dma-buf/st-dma-fence.c b/drivers/dma-buf/st-dma-fence.c
index cb62e606d0a2..b3f88e89cc44 100644
--- a/drivers/dma-buf/st-dma-fence.c
+++ b/drivers/dma-buf/st-dma-fence.c
@@ -31,7 +31,7 @@ static struct dma_fence *mock_fence(void)
 	if (!f)
 		return NULL;
 
-	dma_fence_init(f, &mock_ops, NULL, 0, 0);
+	dma_fence_init(f, &mock_ops, NULL, 0, 0, 0);
 	return f;
 }
 
diff --git a/drivers/dma-buf/st-dma-resv.c b/drivers/dma-buf/st-dma-resv.c
index 0b96136bbd54..c3a920ab3fcf 100644
--- a/drivers/dma-buf/st-dma-resv.c
+++ b/drivers/dma-buf/st-dma-resv.c
@@ -35,7 +35,7 @@ static struct dma_fence *alloc_fence(void)
 	if (!f)
 		return NULL;
 
-	dma_fence_init(f, &fence_ops, &fence_lock, 0, 0);
+	dma_fence_init(f, &fence_ops, &fence_lock, 0, 0, 0);
 	return f;
 }
 
diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c
index 8df20b0218a9..ce43af7e735e 100644
--- a/drivers/dma-buf/sw_sync.c
+++ b/drivers/dma-buf/sw_sync.c
@@ -258,7 +258,7 @@ static struct sync_pt *sync_pt_create(struct sync_timeline *obj,
 
 	sync_timeline_get(obj);
 	dma_fence_init(&pt->base, &timeline_fence_ops, &obj->lock,
-		       obj->context, value);
+		       obj->context, value, 0);
 	INIT_LIST_HEAD(&pt->link);
 
 	spin_lock_irq(&obj->lock);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c
index 9b10d015671c..30ccdb3e0b47 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c
@@ -77,7 +77,7 @@ struct amdgpu_amdkfd_fence *amdgpu_amdkfd_fence_create(u64 context,
 	spin_lock_init(&fence->lock);
 	fence->context_id = context_id;
 	dma_fence_init(&fence->base, &amdkfd_fence_ops, &fence->lock,
-		   context, atomic_inc_return(&fence_seq));
+		   context, atomic_inc_return(&fence_seq), 0);
 
 	return fence;
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index 3043ad041bb4..e635884a218b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -112,7 +112,7 @@ void amdgpu_fence_emit(struct amdgpu_ring *ring, struct amdgpu_fence *af,
 	seq = ++ring->fence_drv.sync_seq;
 	dma_fence_init(fence, &amdgpu_fence_ops,
 		       &ring->fence_drv.lock,
-		       adev->fence_context + ring->idx, seq);
+		       adev->fence_context + ring->idx, seq, 0);
 
 	amdgpu_ring_emit_fence(ring, ring->fence_drv.gpu_addr,
 			       seq, flags | AMDGPU_FENCE_FLAG_INT);
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 63ead8ba6756..92641bc0a378 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -190,7 +190,7 @@ struct dma_fence *drm_crtc_create_fence(struct drm_crtc *crtc)
 		return NULL;
 
 	dma_fence_init(fence, &drm_crtc_fence_ops, &crtc->fence_lock,
-		       crtc->fence_context, ++crtc->fence_seqno);
+		       crtc->fence_context, ++crtc->fence_seqno, 0);
 
 	return fence;
 }
diff --git a/drivers/gpu/drm/drm_writeback.c b/drivers/gpu/drm/drm_writeback.c
index b4a002e6d043..64b06b890f19 100644
--- a/drivers/gpu/drm/drm_writeback.c
+++ b/drivers/gpu/drm/drm_writeback.c
@@ -592,7 +592,7 @@ drm_writeback_get_out_fence(struct drm_writeback_connector *wb_connector)
 
 	dma_fence_init(fence, &drm_writeback_fence_ops,
 		       &wb_connector->fence_lock, wb_connector->fence_context,
-		       ++wb_connector->fence_seqno);
+		       ++wb_connector->fence_seqno, 0);
 
 	return fence;
 }
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
index 5c23182f4d33..36f88e0a2063 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c
@@ -1207,7 +1207,7 @@ static struct dma_fence *etnaviv_gpu_fence_alloc(struct etnaviv_gpu *gpu)
 	f->gpu = gpu;
 
 	dma_fence_init(&f->base, &etnaviv_fence_ops, &gpu->fence_spinlock,
-		       gpu->fence_context, ++gpu->next_fence);
+		       gpu->fence_context, ++gpu->next_fence, 0);
 
 	return &f->base;
 }
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c
index 56489cc127d6..ffaa70191f27 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c
@@ -437,7 +437,7 @@ i915_ttm_memcpy_work_arm(struct i915_ttm_memcpy_work *work,
 	int ret;
 
 	spin_lock_init(&work->lock);
-	dma_fence_init(&work->fence, &dma_fence_memcpy_ops, &work->lock, 0, 0);
+	dma_fence_init(&work->fence, &dma_fence_memcpy_ops, &work->lock, 0, 0, 0);
 	dma_fence_get(&work->fence);
 	ret = dma_fence_add_callback(dep, &work->cb, __memcpy_cb);
 	if (ret) {
diff --git a/drivers/gpu/drm/i915/i915_request.c b/drivers/gpu/drm/i915/i915_request.c
index d2c7b1090df0..640f83615726 100644
--- a/drivers/gpu/drm/i915/i915_request.c
+++ b/drivers/gpu/drm/i915/i915_request.c
@@ -955,7 +955,7 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp)
 		goto err_free;
 
 	dma_fence_init(&rq->fence, &i915_fence_ops, &rq->lock,
-		       tl->fence_context, seqno);
+		       tl->fence_context, seqno, 0);
 
 	RCU_INIT_POINTER(rq->timeline, tl);
 	rq->hwsp_seqno = tl->hwsp_seqno;
diff --git a/drivers/gpu/drm/i915/i915_sw_fence_work.c b/drivers/gpu/drm/i915/i915_sw_fence_work.c
index 366418108f78..4cd44dd26e35 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence_work.c
+++ b/drivers/gpu/drm/i915/i915_sw_fence_work.c
@@ -85,7 +85,7 @@ void dma_fence_work_init(struct dma_fence_work *f,
 {
 	f->ops = ops;
 	spin_lock_init(&f->lock);
-	dma_fence_init(&f->dma, &fence_ops, &f->lock, 0, 0);
+	dma_fence_init(&f->dma, &fence_ops, &f->lock, 0, 0, 0);
 	i915_sw_fence_init(&f->chain, fence_notify);
 	INIT_WORK(&f->work, fence_work);
 }
diff --git a/drivers/gpu/drm/i915/i915_vma_resource.c b/drivers/gpu/drm/i915/i915_vma_resource.c
index a8f2112ce81f..19596410e32f 100644
--- a/drivers/gpu/drm/i915/i915_vma_resource.c
+++ b/drivers/gpu/drm/i915/i915_vma_resource.c
@@ -263,7 +263,7 @@ void __i915_vma_resource_init(struct i915_vma_resource *vma_res)
 {
 	spin_lock_init(&vma_res->lock);
 	dma_fence_init(&vma_res->unbind_fence, &unbind_fence_ops,
-		       &vma_res->lock, 0, 0);
+		       &vma_res->lock, 0, 0, 0);
 	refcount_set(&vma_res->hold_count, 1);
 	i915_sw_fence_init(&vma_res->chain, i915_vma_resource_fence_notify);
 }
diff --git a/drivers/gpu/drm/i915/selftests/i915_sw_fence.c b/drivers/gpu/drm/i915/selftests/i915_sw_fence.c
index 6a305322e30d..ca1f3dbe59f7 100644
--- a/drivers/gpu/drm/i915/selftests/i915_sw_fence.c
+++ b/drivers/gpu/drm/i915/selftests/i915_sw_fence.c
@@ -641,7 +641,7 @@ static struct dma_fence *alloc_dma_fence(void)
 
 	dma = kmalloc_obj(*dma);
 	if (dma)
-		dma_fence_init(dma, &mock_fence_ops, &mock_fence_lock, 0, 0);
+		dma_fence_init(dma, &mock_fence_ops, &mock_fence_lock, 0, 0, 0);
 
 	return dma;
 }
diff --git a/drivers/gpu/drm/imagination/pvr_ccb.c b/drivers/gpu/drm/imagination/pvr_ccb.c
index e408df74853d..7043b491fe54 100644
--- a/drivers/gpu/drm/imagination/pvr_ccb.c
+++ b/drivers/gpu/drm/imagination/pvr_ccb.c
@@ -645,7 +645,7 @@ pvr_kccb_reserve_slot(struct pvr_device *pvr_dev, struct dma_fence *f)
 		dma_fence_init(&fence->base, &pvr_kccb_fence_ops,
 			       &pvr_dev->kccb.fence_ctx.lock,
 			       pvr_dev->kccb.fence_ctx.id,
-			       atomic_inc_return(&pvr_dev->kccb.fence_ctx.seqno));
+			       atomic_inc_return(&pvr_dev->kccb.fence_ctx.seqno), 0);
 		out_fence = dma_fence_get(&fence->base);
 		list_add_tail(&fence->node, &pvr_dev->kccb.waiters);
 	} else {
diff --git a/drivers/gpu/drm/imagination/pvr_queue.c b/drivers/gpu/drm/imagination/pvr_queue.c
index 24a8645aa913..34b826381aa2 100644
--- a/drivers/gpu/drm/imagination/pvr_queue.c
+++ b/drivers/gpu/drm/imagination/pvr_queue.c
@@ -305,7 +305,7 @@ pvr_queue_fence_init(struct dma_fence *f,
 	INIT_WORK(&fence->release_work, pvr_queue_fence_release_work);
 	dma_fence_init(&fence->base, fence_ops,
 		       &fence_ctx->lock, fence_ctx->id,
-		       atomic_inc_return(&fence_ctx->seqno));
+		       atomic_inc_return(&fence_ctx->seqno), 0);
 }
 
 /**
diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c
index 9a1e6b9ecbe5..fee595b9629a 100644
--- a/drivers/gpu/drm/lima/lima_sched.c
+++ b/drivers/gpu/drm/lima/lima_sched.c
@@ -97,7 +97,7 @@ static struct lima_fence *lima_fence_create(struct lima_sched_pipe *pipe)
 
 	fence->pipe = pipe;
 	dma_fence_init(&fence->base, &lima_fence_ops, &pipe->fence_lock,
-		       pipe->fence_context, ++pipe->fence_seqno);
+		       pipe->fence_context, ++pipe->fence_seqno, 0);
 
 	return fence;
 }
diff --git a/drivers/gpu/drm/msm/msm_fence.c b/drivers/gpu/drm/msm/msm_fence.c
index 3dca8e09c192..1ec59919c32e 100644
--- a/drivers/gpu/drm/msm/msm_fence.c
+++ b/drivers/gpu/drm/msm/msm_fence.c
@@ -197,5 +197,5 @@ msm_fence_init(struct dma_fence *fence, struct msm_fence_context *fctx)
 	WARN_ON(kref_read(&fence->refcount));
 
 	dma_fence_init(&f->base, &msm_fence_ops, &fctx->spinlock,
-		       fctx->context, ++fctx->last_fence);
+		       fctx->context, ++fctx->last_fence, 0);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 11e95c37ce50..97e20954c71b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -216,10 +216,10 @@ nouveau_fence_emit(struct nouveau_fence *fence)
 
 	if (priv->uevent)
 		dma_fence_init(&fence->base, &nouveau_fence_ops_uevent,
-			       &fctx->lock, fctx->context, ++fctx->sequence);
+			       &fctx->lock, fctx->context, ++fctx->sequence, 0);
 	else
 		dma_fence_init(&fence->base, &nouveau_fence_ops_legacy,
-			       &fctx->lock, fctx->context, ++fctx->sequence);
+			       &fctx->lock, fctx->context, ++fctx->sequence, 0);
 	kref_get(&fctx->fence_ref);
 
 	ret = fctx->emit(fence);
diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
index 4ddf4b722ddf..de242d275978 100644
--- a/drivers/gpu/drm/panfrost/panfrost_job.c
+++ b/drivers/gpu/drm/panfrost/panfrost_job.c
@@ -105,7 +105,7 @@ static struct dma_fence *panfrost_fence_create(struct panfrost_device *pfdev, in
 	fence->queue = js_num;
 	fence->seqno = ++js->queue[js_num].emit_seqno;
 	dma_fence_init(&fence->base, &panfrost_fence_ops, &js->job_lock,
-		       js->queue[js_num].fence_context, fence->seqno);
+		       js->queue[js_num].fence_context, fence->seqno, 0);
 
 	return &fence->base;
 }
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c
index a343c5180e01..c46f69ade7a0 100644
--- a/drivers/gpu/drm/panthor/panthor_sched.c
+++ b/drivers/gpu/drm/panthor/panthor_sched.c
@@ -3322,7 +3322,7 @@ queue_run_job(struct drm_sched_job *sched_job)
 		       &panthor_queue_fence_ops,
 		       &queue->fence_ctx.lock,
 		       queue->fence_ctx.id,
-		       atomic64_inc_return(&queue->fence_ctx.seqno));
+		       atomic64_inc_return(&queue->fence_ctx.seqno), 0);
 
 	job->profiling.slot = queue->profiling.seqno++;
 	if (queue->profiling.seqno == queue->profiling.slot_count)
diff --git a/drivers/gpu/drm/qxl/qxl_release.c b/drivers/gpu/drm/qxl/qxl_release.c
index 06979d0e8a9f..2608d82f7370 100644
--- a/drivers/gpu/drm/qxl/qxl_release.c
+++ b/drivers/gpu/drm/qxl/qxl_release.c
@@ -430,7 +430,7 @@ void qxl_release_fence_buffer_objects(struct qxl_release *release)
 	 * set the highest bits. This will break if we really allow exporting of dma-bufs.
 	 */
 	dma_fence_init(&release->base, &qxl_fence_ops, &qdev->release_lock,
-		       release->id | 0xf0000000, release->base.seqno);
+		       release->id | 0xf0000000, release->base.seqno, 0);
 	trace_dma_fence_emit(&release->base);
 
 	list_for_each_entry(entry, &release->bos, list) {
diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
index 8e9402b8811b..1360b5215f5e 100644
--- a/drivers/gpu/drm/radeon/radeon_fence.c
+++ b/drivers/gpu/drm/radeon/radeon_fence.c
@@ -148,7 +148,7 @@ int radeon_fence_emit(struct radeon_device *rdev,
 	dma_fence_init(&(*fence)->base, &radeon_fence_ops,
 		       &rdev->fence_queue.lock,
 		       rdev->fence_context + ring,
-		       seq);
+		       seq, 0);
 	radeon_fence_ring_emit(rdev, ring, *fence);
 	trace_radeon_fence_emit(rdev_to_drm(rdev), ring, (*fence)->seq);
 	radeon_fence_schedule_check(rdev, ring);
diff --git a/drivers/gpu/drm/scheduler/sched_fence.c b/drivers/gpu/drm/scheduler/sched_fence.c
index b7a4cb921234..94ba0cf4fe02 100644
--- a/drivers/gpu/drm/scheduler/sched_fence.c
+++ b/drivers/gpu/drm/scheduler/sched_fence.c
@@ -229,9 +229,9 @@ void drm_sched_fence_init(struct drm_sched_fence *fence,
 	fence->sched = entity->rq->sched;
 	seq = atomic_inc_return(&entity->fence_seq);
 	dma_fence_init(&fence->scheduled, &drm_sched_fence_ops_scheduled,
-		       &fence->lock, entity->fence_context, seq);
+		       &fence->lock, entity->fence_context, seq, 0);
 	dma_fence_init(&fence->finished, &drm_sched_fence_ops_finished,
-		       &fence->lock, entity->fence_context + 1, seq);
+		       &fence->lock, entity->fence_context + 1, seq, 0);
 }
 
 module_init(drm_sched_fence_slab_init);
diff --git a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
index 2dfa3efef210..169792a4b329 100644
--- a/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
+++ b/drivers/gpu/drm/scheduler/tests/mock_scheduler.c
@@ -173,7 +173,7 @@ static struct dma_fence *mock_sched_run_job(struct drm_sched_job *sched_job)
 		       &drm_mock_sched_hw_fence_ops,
 		       &sched->lock,
 		       sched->hw_timeline.context,
-		       atomic_inc_return(&sched->hw_timeline.next_seqno));
+		       atomic_inc_return(&sched->hw_timeline.next_seqno), 0);
 
 	dma_fence_get(&job->hw_fence); /* Reference for the job_list */
 
diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
index f3103307b5df..633cc7458505 100644
--- a/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
+++ b/drivers/gpu/drm/ttm/tests/ttm_bo_test.c
@@ -450,7 +450,7 @@ static void ttm_bo_fini_shared_resv(struct kunit *test)
 	KUNIT_ASSERT_NOT_NULL(test, fence);
 
 	spin_lock_init(&fence_lock);
-	dma_fence_init(fence, &mock_fence_ops, &fence_lock, 0, 0);
+	dma_fence_init(fence, &mock_fence_ops, &fence_lock, 0, 0, 0);
 
 	dma_resv_lock(external_resv, NULL);
 	dma_resv_reserve_fences(external_resv, 1);
diff --git a/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c b/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
index 56ad8ef32584..e22a1335f166 100644
--- a/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
+++ b/drivers/gpu/drm/ttm/tests/ttm_bo_validate_test.c
@@ -57,7 +57,7 @@ static struct dma_fence *alloc_mock_fence(struct kunit *test)
 	fence = kunit_kzalloc(test, sizeof(*fence), GFP_KERNEL);
 	KUNIT_ASSERT_NOT_NULL(test, fence);
 
-	dma_fence_init(fence, &fence_ops, &fence_lock, 0, 0);
+	dma_fence_init(fence, &fence_ops, &fence_lock, 0, 0, 0);
 
 	return fence;
 }
diff --git a/drivers/gpu/drm/v3d/v3d_fence.c b/drivers/gpu/drm/v3d/v3d_fence.c
index c500136d0455..1fdba5a21580 100644
--- a/drivers/gpu/drm/v3d/v3d_fence.c
+++ b/drivers/gpu/drm/v3d/v3d_fence.c
@@ -16,7 +16,7 @@ struct dma_fence *v3d_fence_create(struct v3d_dev *v3d, enum v3d_queue q)
 	fence->queue = q;
 	fence->seqno = ++queue->emit_seqno;
 	dma_fence_init(&fence->base, &v3d_fence_ops, &queue->queue_lock,
-		       queue->fence_context, fence->seqno);
+		       queue->fence_context, fence->seqno, 0);
 
 	return &fence->base;
 }
diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
index 0ea921bab906..d2ddafe6f87a 100644
--- a/drivers/gpu/drm/vc4/vc4_gem.c
+++ b/drivers/gpu/drm/vc4/vc4_gem.c
@@ -648,7 +648,7 @@ vc4_queue_submit(struct drm_device *dev, struct vc4_exec_info *exec,
 	exec->seqno = seqno;
 
 	dma_fence_init(&fence->base, &vc4_fence_ops, &vc4->job_lock,
-		       vc4->dma_fence_context, exec->seqno);
+		       vc4->dma_fence_context, exec->seqno, 0);
 	fence->seqno = exec->seqno;
 	exec->fence = &fence->base;
 
diff --git a/drivers/gpu/drm/vgem/vgem_fence.c b/drivers/gpu/drm/vgem/vgem_fence.c
index 0e53ba7db629..18700e5f9167 100644
--- a/drivers/gpu/drm/vgem/vgem_fence.c
+++ b/drivers/gpu/drm/vgem/vgem_fence.c
@@ -77,7 +77,7 @@ static struct dma_fence *vgem_fence_create(struct vgem_file *vfile,
 
 	spin_lock_init(&fence->lock);
 	dma_fence_init(&fence->base, &vgem_fence_ops, &fence->lock,
-		       dma_fence_context_alloc(1), 1);
+		       dma_fence_context_alloc(1), 1, 0);
 
 	timer_setup(&fence->timer, vgem_fence_timeout, TIMER_IRQSAFE);
 
diff --git a/drivers/gpu/drm/virtio/virtgpu_fence.c b/drivers/gpu/drm/virtio/virtgpu_fence.c
index c3e66ef2133a..8e469391d2e4 100644
--- a/drivers/gpu/drm/virtio/virtgpu_fence.c
+++ b/drivers/gpu/drm/virtio/virtgpu_fence.c
@@ -76,7 +76,7 @@ struct virtio_gpu_fence *virtio_gpu_fence_alloc(struct virtio_gpu_device *vgdev,
 	 */
 
 	dma_fence_init(&fence->f, &virtio_gpu_fence_ops, &drv->lock,
-		       fence_context, 0);
+		       fence_context, 0, 0);
 
 	return fence;
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index 384c6736cf6b..15f355dc6881 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
@@ -163,7 +163,7 @@ static int vmw_fence_obj_init(struct vmw_fence_manager *fman,
 	int ret = 0;
 
 	dma_fence_init(&fence->base, &vmw_fence_ops, &fman->lock,
-		       fman->ctx, seqno);
+		       fman->ctx, seqno, 0);
 	fence->destroy = destroy;
 
 	spin_lock(&fman->lock);
diff --git a/drivers/gpu/drm/xe/xe_hw_fence.c b/drivers/gpu/drm/xe/xe_hw_fence.c
index 14720623ad00..30bfc42972e0 100644
--- a/drivers/gpu/drm/xe/xe_hw_fence.c
+++ b/drivers/gpu/drm/xe/xe_hw_fence.c
@@ -243,7 +243,7 @@ void xe_hw_fence_init(struct dma_fence *fence, struct xe_hw_fence_ctx *ctx,
 	INIT_LIST_HEAD(&hw_fence->irq_link);
 
 	dma_fence_init(fence, &xe_hw_fence_ops, &ctx->irq->lock,
-		       ctx->dma_fence_ctx, ctx->next_seqno++);
+		       ctx->dma_fence_ctx, ctx->next_seqno++, 0);
 
 	trace_xe_hw_fence_create(hw_fence);
 }
diff --git a/drivers/gpu/drm/xe/xe_oa.c b/drivers/gpu/drm/xe/xe_oa.c
index a3484e943c55..2860fe73971f 100644
--- a/drivers/gpu/drm/xe/xe_oa.c
+++ b/drivers/gpu/drm/xe/xe_oa.c
@@ -1045,7 +1045,7 @@ static int xe_oa_emit_oa_config(struct xe_oa_stream *stream, struct xe_oa_config
 
 	/* Point of no return: initialize and set fence to signal */
 	spin_lock_init(&ofence->lock);
-	dma_fence_init(&ofence->base, &xe_oa_fence_ops, &ofence->lock, 0, 0);
+	dma_fence_init(&ofence->base, &xe_oa_fence_ops, &ofence->lock, 0, 0, 0);
 
 	for (i = 0; i < stream->num_syncs; i++) {
 		if (stream->syncs[i].flags & DRM_XE_SYNC_FLAG_SIGNAL)
diff --git a/drivers/gpu/drm/xe/xe_preempt_fence.c b/drivers/gpu/drm/xe/xe_preempt_fence.c
index 4aa570fe745d..343f1ba1e1cd 100644
--- a/drivers/gpu/drm/xe/xe_preempt_fence.c
+++ b/drivers/gpu/drm/xe/xe_preempt_fence.c
@@ -154,7 +154,7 @@ xe_preempt_fence_arm(struct xe_preempt_fence *pfence, struct xe_exec_queue *q,
 	pfence->q = xe_exec_queue_get(q);
 	spin_lock_init(&pfence->lock);
 	dma_fence_init(&pfence->base, &preempt_fence_ops,
-		      &pfence->lock, context, seqno);
+		      &pfence->lock, context, seqno, 0);
 
 	return &pfence->base;
 }
diff --git a/drivers/gpu/drm/xe/xe_tlb_inval.c b/drivers/gpu/drm/xe/xe_tlb_inval.c
index dd1030de9ab6..8edf64337196 100644
--- a/drivers/gpu/drm/xe/xe_tlb_inval.c
+++ b/drivers/gpu/drm/xe/xe_tlb_inval.c
@@ -490,7 +490,7 @@ void xe_tlb_inval_fence_init(struct xe_tlb_inval *tlb_inval,
 
 	spin_lock_irq(&tlb_inval->lock);
 	dma_fence_init(&fence->base, &inval_fence_ops, &tlb_inval->lock,
-		       dma_fence_context_alloc(1), 1);
+		       dma_fence_context_alloc(1), 1, 0);
 	spin_unlock_irq(&tlb_inval->lock);
 	INIT_LIST_HEAD(&fence->link);
 	if (stack)
diff --git a/drivers/gpu/host1x/fence.c b/drivers/gpu/host1x/fence.c
index 1acf579c562b..7e074e72a055 100644
--- a/drivers/gpu/host1x/fence.c
+++ b/drivers/gpu/host1x/fence.c
@@ -136,7 +136,7 @@ struct dma_fence *host1x_fence_create(struct host1x_syncpt *sp, u32 threshold,
 	fence->timeout = timeout;
 
 	dma_fence_init(&fence->base, &host1x_syncpt_fence_ops, &sp->fences.lock,
-		       dma_fence_context_alloc(1), 0);
+		       dma_fence_context_alloc(1), 0, 0);
 
 	INIT_DELAYED_WORK(&fence->timeout_work, do_fence_timeout);
 
diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 2c9ec93dff47..57d8a61e5054 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -1900,7 +1900,7 @@ static int iio_buffer_enqueue_dmabuf(struct iio_dev_buffer_pair *ib,
 	 * the dma_fence.
 	 */
 	dma_fence_init(&fence->base, &iio_buffer_dma_fence_ops,
-		       &fence->lock, priv->context, seqno);
+		       &fence->lock, priv->context, seqno, 0);
 
 	ret = iio_dma_resv_lock(dmabuf, nonblock);
 	if (ret)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 43962e05eacf..dd09f71d2069 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1733,7 +1733,7 @@ static int ffs_dmabuf_transfer(struct file *file,
 	seqno = atomic_add_return(1, &epfile->seqno);
 
 	dma_fence_init(&fence->base, &ffs_dmabuf_fence_ops,
-		       &priv->lock, priv->context, seqno);
+		       &priv->lock, priv->context, seqno, 0);
 
 	resv_dir = epfile->in ? DMA_RESV_USAGE_READ : DMA_RESV_USAGE_WRITE;
 
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index dd07d128adc3..0cb425f7d5e9 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -103,6 +103,11 @@ struct dma_fence {
 	int error;
 };
 
+/** enum dma_fence_flag_bits - internal dma_fence flags
+ *
+ * These flags are all only for internal usage, with the exception of the
+ * remaining free bits beginning at DMA_FENCE_FLAG_USER_BITS.
+ */
 enum dma_fence_flag_bits {
 	DMA_FENCE_FLAG_INITIALIZED_BIT,
 	DMA_FENCE_FLAG_INLINE_LOCK_BIT,
@@ -110,9 +115,21 @@ enum dma_fence_flag_bits {
 	DMA_FENCE_FLAG_SIGNALED_BIT,
 	DMA_FENCE_FLAG_TIMESTAMP_BIT,
 	DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
+
 	DMA_FENCE_FLAG_USER_BITS, /* must always be last member */
 };
 
+/** enum dma_fence_init_flag_bits - flags the user can specify for new fences
+ *
+ * These flags can be passed in dma_fence_init().
+ *
+ * DMA_FENCE_FLAG_SEQNO64_BIT - use 64-bit sequence numbers
+ */
+enum dma_fence_init_flags {
+	/* Must always be last member. */
+	DMA_FENCE_INIT_FLAG_NR_OF_FLAGs,
+};
+
 typedef void (*dma_fence_func_t)(struct dma_fence *fence,
 				 struct dma_fence_cb *cb);
 
@@ -279,11 +296,10 @@ struct dma_fence_ops {
 };
 
 void dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
-		    spinlock_t *lock, u64 context, u64 seqno);
-
+		    spinlock_t *lock, u64 context, u64 seqno,
+		    unsigned long flags);
 void dma_fence_init64(struct dma_fence *fence, const struct dma_fence_ops *ops,
 		      spinlock_t *lock, u64 context, u64 seqno);
-
 void dma_fence_release(struct kref *kref);
 void dma_fence_free(struct dma_fence *fence);
 void dma_fence_describe(struct dma_fence *fence, struct seq_file *seq);
-- 
2.56.0

[RFC PATCH 2/6] dma-buf: dma-fence: Add flag for using 64-bit seqnos

[Philipp Stanner]

dma_fence_init() now has its own flag field for user options. Use this
field to enable 64-bit seqno support through a dedicated field.

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/dma-buf/dma-fence.c | 8 +++++++-
 include/linux/dma-fence.h   | 4 +++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index a640fb99f942..b11ee52a40d8 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -1114,7 +1114,13 @@ dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
 	       spinlock_t *lock, u64 context, u64 seqno,
 	       unsigned long init_flags)
 {
-	__dma_fence_init(fence, ops, lock, context, seqno, 0);
+	unsigned long fence_flag_bits = 0;
+
+	/* Mapp the init_flags to the fence-internal flags. */
+	if (test_bit(DMA_FENCE_INIT_FLAG_SEQNO64, &init_flags))
+		set_bit(DMA_FENCE_FLAG_SEQNO64_BIT, &fence_flag_bits);
+
+	__dma_fence_init(fence, ops, lock, context, seqno, fence_flag_bits);
 }
 EXPORT_SYMBOL(dma_fence_init);
 
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index 0cb425f7d5e9..6654bcc2441f 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -123,9 +123,11 @@ enum dma_fence_flag_bits {
  *
  * These flags can be passed in dma_fence_init().
  *
- * DMA_FENCE_FLAG_SEQNO64_BIT - use 64-bit sequence numbers
+ * @DMA_FENCE_INIT_FLAG_SEQNO64: Use 64-bit sequence numbers.
  */
 enum dma_fence_init_flags {
+	DMA_FENCE_INIT_FLAG_SEQNO64,
+
 	/* Must always be last member. */
 	DMA_FENCE_INIT_FLAG_NR_OF_FLAGs,
 };
-- 
2.56.0

[RFC PATCH 3/6] dma-buf: Port users of dma_fence_init64()

[Philipp Stanner]

dma_fence_init() now natively allows for selecting 64-bit seqno support.
Port all users of dma_fence_init64() to this unified method.

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/dma-buf/dma-fence-chain.c                  | 4 ++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c | 7 ++++---
 drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c    | 5 +++--
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c   | 5 +++--
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/drivers/dma-buf/dma-fence-chain.c b/drivers/dma-buf/dma-fence-chain.c
index a588f55ea4d3..706e1f5e3a23 100644
--- a/drivers/dma-buf/dma-fence-chain.c
+++ b/drivers/dma-buf/dma-fence-chain.c
@@ -261,8 +261,8 @@ void dma_fence_chain_init(struct dma_fence_chain *chain,
 			seqno = max(prev->seqno, seqno);
 	}
 
-	dma_fence_init64(&chain->base, &dma_fence_chain_ops, NULL,
-			 context, seqno);
+	dma_fence_init(&chain->base, &dma_fence_chain_ops, NULL,
+		       context, seqno, BIT(DMA_FENCE_INIT_FLAG_SEQNO64));
 
 	/*
 	 * dma_fence_chain_enable_signaling() is invoked while holding
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c
index f6b7522c3c82..1337f7f4195f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_eviction_fence.c
@@ -130,9 +130,10 @@ int amdgpu_evf_mgr_rearm(struct amdgpu_eviction_fence_mgr *evf_mgr,
 	ev_fence->evf_mgr = evf_mgr;
 	get_task_comm(ev_fence->timeline_name, current);
 	spin_lock_init(&ev_fence->lock);
-	dma_fence_init64(&ev_fence->base, &amdgpu_eviction_fence_ops,
-			 &ev_fence->lock, evf_mgr->ev_fence_ctx,
-			 atomic_inc_return(&evf_mgr->ev_fence_seq));
+	dma_fence_init(&ev_fence->base, &amdgpu_eviction_fence_ops,
+		       &ev_fence->lock, evf_mgr->ev_fence_ctx,
+		       atomic_inc_return(&evf_mgr->ev_fence_seq),
+		       BIT(DMA_FENCE_INIT_FLAG_SEQNO64));
 
 	/* Remember it for newly added BOs */
 	dma_fence_put(evf_mgr->ev_fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
index 6f1dc813ec5b..199cc1835448 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c
@@ -274,8 +274,9 @@ static void amdgpu_userq_fence_init(struct amdgpu_usermode_queue *userq,
 	bool signaled = false;
 
 	spin_lock_init(&fence->lock);
-	dma_fence_init64(&fence->base, &amdgpu_userq_fence_ops, &fence->lock,
-			 fence_drv->context, seq);
+	dma_fence_init(&fence->base, &amdgpu_userq_fence_ops, &fence->lock,
+		       fence_drv->context, seq,
+		       BIT(DMA_FENCE_INIT_FLAG_SEQNO64));
 
 	/* Make sure the fence is visible to the hang detect worker */
 	dma_fence_put(userq->last_fence);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c
index b0002c898386..8b9b9368956f 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c
@@ -100,8 +100,9 @@ void amdgpu_vm_tlb_fence_create(struct amdgpu_device *adev, struct amdgpu_vm *vm
 	INIT_WORK(&f->work, amdgpu_tlb_fence_work);
 	spin_lock_init(&f->lock);
 
-	dma_fence_init64(&f->base, &amdgpu_tlb_fence_ops, &f->lock,
-			 vm->tlb_fence_context, atomic64_read(&vm->tlb_seq));
+	dma_fence_init(&f->base, &amdgpu_tlb_fence_ops, &f->lock,
+		       vm->tlb_fence_context, atomic64_read(&vm->tlb_seq),
+		       BIT(DMA_FENCE_INIT_FLAG_SEQNO64));
 
 	/* TODO: We probably need a separate wq here */
 	dma_fence_get(&f->base);
-- 
2.56.0

[RFC PATCH 4/6] dma-buf: dma-fence: remove dma_fence_init64()

[Philipp Stanner]

All users of dma_fence_init64() have been removed. They now use the
respective initialization flag in dma_fence_init().

Remove dma_fence_init64().

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/dma-buf/dma-fence.c | 27 ---------------------------
 include/linux/dma-fence.h   |  2 --
 2 files changed, 29 deletions(-)

diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index b11ee52a40d8..f7c084926ae6 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -1124,33 +1124,6 @@ dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
 }
 EXPORT_SYMBOL(dma_fence_init);
 
-/**
- * dma_fence_init64 - Initialize a custom fence with 64-bit seqno support.
- * @fence: the fence to initialize
- * @ops: the dma_fence_ops for operations on this fence
- * @lock: optional irqsafe spinlock to use for locking this fence
- * @context: the execution context this fence is run on
- * @seqno: a linear increasing sequence number for this context
- *
- * Initializes an allocated fence, the caller doesn't have to keep its
- * refcount after committing with this fence, but it will need to hold a
- * refcount again if &dma_fence_ops.enable_signaling gets called.
- *
- * Context and seqno are used for easy comparison between fences, allowing
- * to check which fence is later by simply using dma_fence_later().
- *
- * New users MUST NOT use external locks. Check the documentation in
- * dma_fence_init() to understand the motives behind the legacy use cases.
- */
-void
-dma_fence_init64(struct dma_fence *fence, const struct dma_fence_ops *ops,
-		 spinlock_t *lock, u64 context, u64 seqno)
-{
-	__dma_fence_init(fence, ops, lock, context, seqno,
-			 BIT(DMA_FENCE_FLAG_SEQNO64_BIT));
-}
-EXPORT_SYMBOL(dma_fence_init64);
-
 /**
  * dma_fence_driver_name - Access the driver name
  * @fence: the fence to query
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index 6654bcc2441f..52e7ddfd2d06 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -300,8 +300,6 @@ struct dma_fence_ops {
 void dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
 		    spinlock_t *lock, u64 context, u64 seqno,
 		    unsigned long flags);
-void dma_fence_init64(struct dma_fence *fence, const struct dma_fence_ops *ops,
-		      spinlock_t *lock, u64 context, u64 seqno);
 void dma_fence_release(struct kref *kref);
 void dma_fence_free(struct dma_fence *fence);
 void dma_fence_describe(struct dma_fence *fence, struct seq_file *seq);
-- 
2.56.0

[RFC PATCH 5/6] dma-buf: dma-fence: Close race in dma_fence_is_signaled() by default

[Philipp Stanner]

dma_fence_is_signaled() contains a lockless check of the signaled-bit,
which is set under lock protection. This is a race condition which makes
the API fragile and has caused at least two bugs already, addressed in:

	commit c8a5d5ea3ba6 ("nouveau: fix client work fence deletion race")
	commit 7c703a7d3f2b ("drm/amdgpu: Fix one use-after-free of VM")

It has been argued by some that this race cannot be closed for the
entire kernel through locking because this would lead to a cache line
invalidation for all parties reading that fence. While it remains
unclear why these parties don't simply let themselves be notified about
the fence being signaled instead of checking this repeatedly manually,
there is a way to preserve this behavior in any case:

This patch adds a new flag for dma_fence_init(),
DMA_FENCE_INIT_FLAG_RACY_SIGNALED_CHECK. If this flag is not set, the
spinlock is taken and dma_fence_is_signaled() becomes perfectly
synchronized: it can only return true once signaling of the fence is
completed.

Disable the racy check for everyone by default. Should some parties
really experience severe performance degredations because of this, they
can trivially re-enable the race condition for their driver by setting
the flag in dma_fence_init().

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/dma-buf/dma-fence.c |  2 ++
 include/linux/dma-fence.h   | 22 ++++++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
index f7c084926ae6..1ae8c7aade39 100644
--- a/drivers/dma-buf/dma-fence.c
+++ b/drivers/dma-buf/dma-fence.c
@@ -1119,6 +1119,8 @@ dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
 	/* Mapp the init_flags to the fence-internal flags. */
 	if (test_bit(DMA_FENCE_INIT_FLAG_SEQNO64, &init_flags))
 		set_bit(DMA_FENCE_FLAG_SEQNO64_BIT, &fence_flag_bits);
+	if (test_bit(DMA_FENCE_INIT_FLAG_RACY_SIGNALED_CHECK, &init_flags))
+		set_bit(DMA_FENCE_FLAG_RACY_SIGNALED_CHECK_BIT, &fence_flag_bits);
 
 	__dma_fence_init(fence, ops, lock, context, seqno, fence_flag_bits);
 }
diff --git a/include/linux/dma-fence.h b/include/linux/dma-fence.h
index 52e7ddfd2d06..ee6e8de3ebc6 100644
--- a/include/linux/dma-fence.h
+++ b/include/linux/dma-fence.h
@@ -115,6 +115,7 @@ enum dma_fence_flag_bits {
 	DMA_FENCE_FLAG_SIGNALED_BIT,
 	DMA_FENCE_FLAG_TIMESTAMP_BIT,
 	DMA_FENCE_FLAG_ENABLE_SIGNAL_BIT,
+	DMA_FENCE_FLAG_RACY_SIGNALED_CHECK_BIT,
 
 	DMA_FENCE_FLAG_USER_BITS, /* must always be last member */
 };
@@ -124,9 +125,12 @@ enum dma_fence_flag_bits {
  * These flags can be passed in dma_fence_init().
  *
  * @DMA_FENCE_INIT_FLAG_SEQNO64: Use 64-bit sequence numbers.
+ * @DMA_FENCE_INIT_FLAG_RACY_SIGNALED_CHECK:
+ * Legacy flag. Enables a race condition in dma_fence_is_signaled().
  */
 enum dma_fence_init_flags {
 	DMA_FENCE_INIT_FLAG_SEQNO64,
+	DMA_FENCE_INIT_FLAG_RACY_SIGNALED_CHECK,
 
 	/* Must always be last member. */
 	DMA_FENCE_INIT_FLAG_NR_OF_FLAGs,
@@ -568,9 +572,27 @@ dma_fence_is_signaled_locked(struct dma_fence *fence)
 static inline bool
 dma_fence_is_signaled(struct dma_fence *fence)
 {
+	const bool racy_check = test_bit(DMA_FENCE_FLAG_RACY_SIGNALED_CHECK_BIT,
+					 &fence->flags);
 	const struct dma_fence_ops *ops;
+	bool signaled = false;
+	unsigned long flags;
 
+	/*
+	 * For legacy reasons, there is a race window here against parties
+	 * signaling the fence. They might still be doing that right now.
+	 *
+	 * For most users, this window shall be closed, but there are parties
+	 * for whom the cache-line invalidation by taking the lock might be so
+	 * significant that they prefer to accept the race at their own risk.
+	 */
+	if (!racy_check)
+		dma_fence_lock_irqsave(fence, flags);
 	if (dma_fence_test_signaled_flag(fence))
+		signaled = true;
+	if (!racy_check)
+		dma_fence_unlock_irqrestore(fence, flags);
+	if (signaled)
 		return true;
 
 	rcu_read_lock();
-- 
2.56.0

[RFC PATCH 6/6] drm/nouveau: Remove hacky fence check

[Philipp Stanner]

nouveau_cli_work() contains a section where a dma_fence lock is manually
taken and immediately released afterwards. This was added in

	commit c8a5d5ea3ba6 ("nouveau: fix client work fence deletion race")

as a bugfix because the function dma_fence_is_signaled() could return
true while the fence was still signaling.

The fix was later modified in

	commit a80d12eafad1 ("drm/nouveau: Simplify nouveau_cli_work")

Luckily, the dma_fence backend now fully synchronizes
dma_fence_is_signaled() with the spinlock. Thus, the check in nouveau is
not necessary anymore.

Remove the manual lock-unlock section.

Signed-off-by: Philipp Stanner <phasta@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_drm.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index b0f9fb10a74d..74632bb29f2f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -163,19 +163,6 @@ nouveau_cli_work(struct work_struct *w)
 		struct dma_fence *fence = work->fence;
 
 		if (!fence || dma_fence_is_signaled(fence)) {
-			if (fence) {
-				unsigned long flags;
-
-				/*
-				 * Because fence can still be in the process of
-				 * processing the callback list, and the
-				 * callback references the work we are about to
-				 * free, we need to sync with the callback
-				 * processing before freeing the work.
-				 */
-				dma_fence_lock_irqsave(fence, flags);
-				dma_fence_unlock_irqrestore(fence, flags);
-			}
 			list_del(&work->head);
 			work->func(work);
 			dma_fence_put(fence);
-- 
2.56.0

Re: [RFC PATCH 0/6] dma-buf: Phase out is_signaled() race

[Lucas Stach]

Hi Philipp, hi Christian,

Am Donnerstag, dem 29.10.2026 um 10:55 +0100 schrieb Philipp Stanner:
> dma_fence_is_signaled() can return true *while* the fence is signaling.
> This has caused explosions before and I guess we can agree that it's
> just not ideal.
> 
> The fundamental issue is that the fence-signaled-bit is set under lock
> protection but read without it.
> 
> So ideally, we would read it with the lock. This would not change the
> relative order, i.e. the bit would still be true in the fence callbacks.
> 
> Christian informs us that taking the lock causes people to complain
> about performance regressions because the lock-taking shoots down copied
> cache-lines. (which is weird since it would mean that someone is
> repeatedly polling on fences instead of just registering a callback to
> notify himself once it signals)
> 
I think we would all be interested in the actual use-case that's
sensitive to this kind of latency.

However, I wonder if this is even an issue anymore with the lock
inlined into the fence structure. With the deprecated external lock you
would potentially get two cacheline bounces/remote invalidations for
the exclusive access: once for the lock and one for the
test_and_set_bit atomic op on the flags field.
Now with the inlined lock, the lock operation will bring the cacheline
into exclusive state on the local CPU and the flag check would then
operate on that same cacheline, so there should be only a very minimal
penalty compared to the sole atomic op.

Regards,
Lucas

> Let's accept the potential for regressions as true for now.
> Nevertheless, I think I can propose a path towards removing the race:
> 
> This series suggests taking the lock in dma_fence_is_signaled() *unless*
> the driver explicitly asks for a check with a race-condition.
> 
> As a preparation, I allow drivers to set flags when initializing fences.
> Then, we add a flag with which the driver can switch locking off for
> that particular function.
> 
> By default, we let all drivers take the lock.
> 
> Should we then, in the kernel release process get reports about
> regressions, we can set the race-flag for the affected driver and
> restore the old behavior.
> 
> Should there be no reports, we could phase the flag out again after a
> few releases, always taking the lock.
> 
> New users would always see the lock.
> 
> I put all potentially affected parties on Cc. Please point out if you
> can already foresee your driver being negatively affected by this.
> 
> P.
> 
> 
> Philipp Stanner (6):
>   dma-buf: dma-fence: Add flags parameter to dma_fence_init()
>   dma-buf: dma-fence: Add flag for using 64-bit seqnos
>   dma-buf: Port users of dma_fence_init64()
>   dma-buf: dma-fence: remove dma_fence_init64()
>   dma-buf: dma-fence: Close race in dma_fence_is_signaled() by default
>   drm/nouveau: Remove hacky fence check
> 
>  drivers/accel/amdxdna/amdxdna_ctx.c           |  2 +-
>  drivers/accel/ethosu/ethosu_job.c             |  2 +-
>  drivers/accel/ivpu/ivpu_job.c                 |  2 +-
>  drivers/accel/rocket/rocket_job.c             |  2 +-
>  drivers/dma-buf/dma-fence-array.c             |  2 +-
>  drivers/dma-buf/dma-fence-chain.c             |  4 +-
>  drivers/dma-buf/dma-fence.c                   | 44 +++++------------
>  drivers/dma-buf/st-dma-fence-chain.c          |  2 +-
>  drivers/dma-buf/st-dma-fence-unwrap.c         |  2 +-
>  drivers/dma-buf/st-dma-fence.c                |  2 +-
>  drivers/dma-buf/st-dma-resv.c                 |  2 +-
>  drivers/dma-buf/sw_sync.c                     |  2 +-
>  .../gpu/drm/amd/amdgpu/amdgpu_amdkfd_fence.c  |  2 +-
>  .../drm/amd/amdgpu/amdgpu_eviction_fence.c    |  7 +--
>  drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c     |  2 +-
>  .../gpu/drm/amd/amdgpu/amdgpu_userq_fence.c   |  5 +-
>  .../gpu/drm/amd/amdgpu/amdgpu_vm_tlb_fence.c  |  5 +-
>  drivers/gpu/drm/drm_crtc.c                    |  2 +-
>  drivers/gpu/drm/drm_writeback.c               |  2 +-
>  drivers/gpu/drm/etnaviv/etnaviv_gpu.c         |  2 +-
>  drivers/gpu/drm/i915/gem/i915_gem_ttm_move.c  |  2 +-
>  drivers/gpu/drm/i915/i915_request.c           |  2 +-
>  drivers/gpu/drm/i915/i915_sw_fence_work.c     |  2 +-
>  drivers/gpu/drm/i915/i915_vma_resource.c      |  2 +-
>  .../gpu/drm/i915/selftests/i915_sw_fence.c    |  2 +-
>  drivers/gpu/drm/imagination/pvr_ccb.c         |  2 +-
>  drivers/gpu/drm/imagination/pvr_queue.c       |  2 +-
>  drivers/gpu/drm/lima/lima_sched.c             |  2 +-
>  drivers/gpu/drm/msm/msm_fence.c               |  2 +-
>  drivers/gpu/drm/nouveau/nouveau_drm.c         | 13 -----
>  drivers/gpu/drm/nouveau/nouveau_fence.c       |  4 +-
>  drivers/gpu/drm/panfrost/panfrost_job.c       |  2 +-
>  drivers/gpu/drm/panthor/panthor_sched.c       |  2 +-
>  drivers/gpu/drm/qxl/qxl_release.c             |  2 +-
>  drivers/gpu/drm/radeon/radeon_fence.c         |  2 +-
>  drivers/gpu/drm/scheduler/sched_fence.c       |  4 +-
>  .../gpu/drm/scheduler/tests/mock_scheduler.c  |  2 +-
>  drivers/gpu/drm/ttm/tests/ttm_bo_test.c       |  2 +-
>  .../gpu/drm/ttm/tests/ttm_bo_validate_test.c  |  2 +-
>  drivers/gpu/drm/v3d/v3d_fence.c               |  2 +-
>  drivers/gpu/drm/vc4/vc4_gem.c                 |  2 +-
>  drivers/gpu/drm/vgem/vgem_fence.c             |  2 +-
>  drivers/gpu/drm/virtio/virtgpu_fence.c        |  2 +-
>  drivers/gpu/drm/vmwgfx/vmwgfx_fence.c         |  2 +-
>  drivers/gpu/drm/xe/xe_hw_fence.c              |  2 +-
>  drivers/gpu/drm/xe/xe_oa.c                    |  2 +-
>  drivers/gpu/drm/xe/xe_preempt_fence.c         |  2 +-
>  drivers/gpu/drm/xe/xe_tlb_inval.c             |  2 +-
>  drivers/gpu/host1x/fence.c                    |  2 +-
>  drivers/iio/industrialio-buffer.c             |  2 +-
>  drivers/usb/gadget/function/f_fs.c            |  2 +-
>  include/linux/dma-fence.h                     | 48 +++++++++++++++++--
>  52 files changed, 115 insertions(+), 105 deletions(-)

Re: [RFC PATCH 0/6] dma-buf: Phase out is_signaled() race

[Philipp Stanner]

On Thu, 2026-10-29 at 11:23 +0100, Lucas Stach wrote:
> Hi Philipp, hi Christian,

Jo Lucas

> 
> Am Donnerstag, dem 29.10.2026 um 10:55 +0100 schrieb Philipp Stanner:

[…]

> I think we would all be interested in the actual use-case that's
> sensitive to this kind of latency.

Me too.

Let me use this opportunity to stress that in the future, in DRM,
whenever we have [to accept] a racy "optimization", both commit
messages and code comments must document why it exists and who
requested it with what proof.

Would save us lots of time when those things are discussed >5 years
later.

> 
> However, I wonder if this is even an issue anymore with the lock
> inlined into the fence structure.

Almost no one uses inline-lock so far. So unfortunately, we might
regress old drivers, maybe.

But sounds as if you're in favor of phasing the locklessness out :)


P.

Re: [RFC PATCH 0/6] dma-buf: Phase out is_signaled() race

[Lucas Stach]

Am Donnerstag, dem 29.10.2026 um 11:28 +0100 schrieb Philipp Stanner:
> On Thu, 2026-10-29 at 11:23 +0100, Lucas Stach wrote:
> > Hi Philipp, hi Christian,
> 
> Jo Lucas
> 
> > 
> > Am Donnerstag, dem 29.10.2026 um 10:55 +0100 schrieb Philipp Stanner:
> 
> […]
> 
> > I think we would all be interested in the actual use-case that's
> > sensitive to this kind of latency.
> 
> Me too.
> 
> Let me use this opportunity to stress that in the future, in DRM,
> whenever we have [to accept] a racy "optimization", both commit
> messages and code comments must document why it exists and who
> requested it with what proof.
> 
I don't fully agree that this is a racy optimization. To me it seems
the most critical issue here is that "fence is signaled" is under
specified.

Does it purely mean that the actual hardware operation that the fence
is guarding is done? In that case the current implementation is fine,
as the bit is only set after the HW told us that it is done. This is
the interpretation I would assume was the original intent behind the
current implementation.

Does it mean that the hardware is done and all registered callbacks
have been run, even if the actual work is done in a (indefinitely)
deferred worker? You mentioning explosions caused by the pure signal
state check outside the lock would imply that some consumers of the
fence took the signaled state to mean this interpretation.

> Would save us lots of time when those things are discussed >5 years
> later.
> 
> > 
> > However, I wonder if this is even an issue anymore with the lock
> > inlined into the fence structure.
> 
> Almost no one uses inline-lock so far. So unfortunately, we might
> regress old drivers, maybe.
> 
> But sounds as if you're in favor of phasing the locklessness out :)
> 
I'm in favor of ripping out hard to reason optimizations if they turn
out to not provide any optimization after all. However, before going in
either direction we need to clarify the fence signal state interface. 

Either we keep the (in my interpretation) original intent of the signal
state only telling about HW progress state and thus declare some
current uses as wrong usage of the interface, which need to be fixed.
Or we need to include the SW callbacks too, but then your current lock
approach only guards against code directly executed in the callback
functions. If the implementation of the callback defers anything to a
worker this may still be racy.
And that's also my criticism to this patchset now that I thought a bit
more about this: by simply putting things under the lock you serialized
more of the SW state without actually better defining the guarantees
that this changed fence interface provides or doesn't provide to the
consumers.

Regards,
Lucas