[PATCH 1/2] drm/xe/guc: Reject a duplicate deregister-done G2H

[Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>]

The registered bit is cleared by the first deregister-done, but the
guc_id is only freed once the deferred destroy work has run, so there is
a small window of time where a duplicate deregister can go through
before the guc id is freed. Add an additional check to block a duplicate
deregister.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Reported-by: Martin Hodo <martin.hodo@intel.com>
Signed-off-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Assisted-by: Claude:claude-opus-5
---
 drivers/gpu/drm/xe/xe_guc_submit.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index f3ba8abfc228..7339c3cecdc0 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -3350,8 +3350,15 @@ int xe_guc_deregister_done_handler(struct xe_guc *guc, u32 *msg, u32 len)
 	if (unlikely(!q))
 		return -EPROTO;
 
-	if (!exec_queue_destroyed(q) || exec_queue_pending_disable(q) ||
-	    exec_queue_pending_enable(q) || exec_queue_enabled(q)) {
+	/*
+	 * The registered bit is cleared by the first deregister-done, but the
+	 * guc_id is only freed once the deferred destroy work has run, so the
+	 * lookup above still resolves in between. Checking it here makes a
+	 * duplicate notification an error rather than a second destroy.
+	 */
+	if (!exec_queue_registered(q) || !exec_queue_destroyed(q) ||
+	    exec_queue_pending_disable(q) || exec_queue_pending_enable(q) ||
+	    exec_queue_enabled(q)) {
 		xe_gt_err(guc_to_gt(guc),
 			  "DEREGISTER_DONE: Unexpected engine state 0x%04x, guc_id=%d",
 			  atomic_read(&q->guc->state), q->guc->id);
-- 
2.53.0