[PATCH v2 1/4] drm/xe: Hold a device reference across deferred VM destruction

[Arvind Yadav <arvind.yadav@intel.com>]

xe_vm_free() is the drm_gpuvm vm_free callback. It hands the final
teardown to vm_destroy_work_func() on a workqueue and returns.

drm_gpuvm_free() drops its device reference immediately after the
callback returns:

	gpuvm->ops->vm_free(gpuvm);
	drm_dev_put(drm);

vm_destroy_work_func() then keeps using device state: xe_pm_runtime_put()
for an LR mode VM, ttm_lru_bulk_move_fini() on xe->ttm, and the tile
iteration. If the freed VM held the last device reference, the work runs
against a released xe_device.

Take a device reference in xe_vm_free() and drop it once
vm_destroy_work_func() has finished using the device.

Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Assisted-by: LLM
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 823e264319a1..a1a4eaf3165f 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -2108,6 +2108,8 @@ static void vm_destroy_work_func(struct work_struct *w)
 		xe_file_put(vm->xef);
 
 	kfree(vm);
+
+	drm_dev_put(&xe->drm);
 }
 
 static void xe_vm_free(struct drm_gpuvm *gpuvm)
@@ -2115,10 +2117,13 @@ static void xe_vm_free(struct drm_gpuvm *gpuvm)
 	struct xe_vm *vm = container_of(gpuvm, struct xe_vm, gpuvm);
 
 	/*
-	 * To destroy the VM we need to be able to sleep.
-	 * drm_gpuvm keeps at least one device reference at this
-	 * point so xe->destroy_wq must still be alive.
+	 * drm_gpuvm drops its device reference as soon as this callback
+	 * returns, but vm_destroy_work_func() still uses device state. Hold a
+	 * reference across the deferred work.
 	 */
+	drm_dev_get(&vm->xe->drm);
+
+	/* To destroy the VM we need to be able to sleep */
 	queue_work(vm->xe->destroy_wq, &vm->destroy_work);
 }
 
-- 
2.43.0