[PATCH] drm/xe/guc: Guard page-fault ack with runtime PM check

[Varun Gupta <varun.gupta@intel.com>]

During VM teardown, the VM's runtime PM reference is dropped
asynchronously, allowing the device to autosuspend while stale page
faults belonging to the now-dead VM are still queued. When the
page-fault worker later tries to ack one of these, it calls into
guc_ct_send_locked() on an already-suspended device, tripping:

  Assertion `!xe_pm_runtime_suspended(xe)` failed!
  WARNING at xe_device.c:1267 xe_device_assert_mem_access+0x11c/0x140 [xe]

A live VM/exec queue always holds a PM reference while it has
outstanding work, so if the device is suspended at ack time, the
owning context is already gone and the fault is stale.

Guard both ack sites (guc_ack_fault() and the batched flush in
guc_ack_fault_end()) with xe_pm_runtime_get_if_active() instead of
forcing a resume. get_if_active() is non-blocking, so it's safe to
call under guc->ct.lock, unlike a blocking get() which would risk
lock-ordering issues against the suspend path and needlessly wake
the device to deliver an ack nobody is waiting for.

Reported-by: Szymon Markiewicz <szymon.markiewicz@intel.com>
Signed-off-by: Varun Gupta <varun.gupta@intel.com>
---
 drivers/gpu/drm/xe/xe_guc_pagefault.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_guc_pagefault.c b/drivers/gpu/drm/xe/xe_guc_pagefault.c
index 8f8210a732e9..a18de20c8245 100644
--- a/drivers/gpu/drm/xe/xe_guc_pagefault.c
+++ b/drivers/gpu/drm/xe/xe_guc_pagefault.c
@@ -9,6 +9,7 @@
 #include "xe_guc_pagefault.h"
 #include "xe_pagefault.h"
 #include "xe_pagefault_types.h"
+#include "xe_pm.h"
 
 #define XE_GUC_PAGEFAULT_FLUSH_PERIOD	BIT(4)	/* Sixteen */
 
@@ -52,19 +53,32 @@ static void guc_ack_fault(struct xe_pagefault *pf, int err)
 		FIELD_PREP(PFR_PDATA, pdata),
 	};
 	struct xe_guc *guc = pf->producer.private;
-	bool write_only = guc->pagefault_ack_counter++ &
+	struct xe_device *xe = guc_to_xe(guc);
+	bool write_only;
+
+	if (!xe_pm_runtime_get_if_active(xe))
+		return;
+
+	write_only = guc->pagefault_ack_counter++ &
 		(XE_GUC_PAGEFAULT_FLUSH_PERIOD - 1);
 
 	xe_guc_ct_send_locked(&guc->ct, action, ARRAY_SIZE(action),
 			      write_only);
+
+	xe_pm_runtime_put(xe);
 }
 
 static void guc_ack_fault_end(void *private)
 {
 	struct xe_guc *guc = private;
+	struct xe_device *xe = guc_to_xe(guc);
 
-	if ((guc->pagefault_ack_counter & (XE_GUC_PAGEFAULT_FLUSH_PERIOD - 1)) != 1)
+	if ((guc->pagefault_ack_counter &
+	     (XE_GUC_PAGEFAULT_FLUSH_PERIOD - 1)) != 1 &&
+	    xe_pm_runtime_get_if_active(xe)) {
 		xe_guc_ct_send_flush(&guc->ct);
+		xe_pm_runtime_put(xe);
+	}
 	xe_guc_ct_unlock(&guc->ct);
 }
 
-- 
2.43.0