[PATCH v4 3/3] drm/xe: Route execlist exec queue teardown off system_dfl_wq

["Thomas Hellström" <thomas.hellstrom@linux.intel.com>]

execlist_exec_queue_destroy() defers the final teardown of a struct
xe_exec_queue (which calls drm_sched_fini()) to a work item queued on
system_dfl_wq, a global, kernel-wide workqueue that xe has no control
over and never waits on during module unload.

For exec queues without an associated xe_vm (e.g. GT-internal kernel
queues, the GSC and OA kernel queues, and one PXP kernel queue), there
is nothing else keeping the xe_device, and hence the module, alive
while this work is queued or running: rmmod xe could succeed and free
the module's text while execlist_exec_queue_destroy_async() is still
queued or running on system_dfl_wq, jumping into freed code from
drm_sched_fini() or the exec queue's own cleanup.

Fix this the same way GuC exec queue teardown already does it: take an
explicit drm_device reference across the deferred teardown, and queue
the work on xe_destroy_wq instead of system_dfl_wq, the module-lifetime
workqueue that is guaranteed to be drained by
xe_destroy_wq_module_exit() before the module can unload. Taking the
reference explicitly, rather than relying on whatever reference an
associated xe_vm may or may not be holding, keeps this exec queue's
teardown self-contained and correct regardless of vm lifetime.

Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Assisted-by: LLM
---
 drivers/gpu/drm/xe/xe_execlist.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_execlist.c b/drivers/gpu/drm/xe/xe_execlist.c
index a36db39dcda8..a6984999962d 100644
--- a/drivers/gpu/drm/xe/xe_execlist.c
+++ b/drivers/gpu/drm/xe/xe_execlist.c
@@ -5,6 +5,7 @@
 
 #include "xe_execlist.h"
 
+#include <drm/drm_drv.h>
 #include <drm/drm_managed.h>
 
 #include "instructions/xe_mi_commands.h"
@@ -21,6 +22,7 @@
 #include "xe_macros.h"
 #include "xe_mmio.h"
 #include "xe_mocs.h"
+#include "xe_module.h"
 #include "xe_ring_ops_types.h"
 #include "xe_sched_job.h"
 
@@ -402,6 +404,7 @@ static void execlist_exec_queue_destroy_async(struct work_struct *w)
 	spin_unlock_irqrestore(&exl->port->lock, flags);
 
 	xe_exec_queue_fini(q);
+	drm_dev_put(&xe->drm);
 }
 
 static void execlist_exec_queue_kill(struct xe_exec_queue *q)
@@ -411,8 +414,9 @@ static void execlist_exec_queue_kill(struct xe_exec_queue *q)
 
 static void execlist_exec_queue_destroy(struct xe_exec_queue *q)
 {
+	drm_dev_get(&gt_to_xe(q->gt)->drm);
 	INIT_WORK(&q->execlist->destroy_async, execlist_exec_queue_destroy_async);
-	queue_work(system_dfl_wq, &q->execlist->destroy_async);
+	xe_destroy_wq_queue(&q->execlist->destroy_async);
 }
 
 static int execlist_exec_queue_set_priority(struct xe_exec_queue *q,
-- 
2.55.0