[PATCH v2 1/1] drm/xe/guc: Fix wake_up race in handle_sched_done

[Jakub Legowski <jakub.legowski@intel.com>]

Move wake_up_all() after clear_exec_queue_pending_disable()

When a SCHED_DONE G2H arrives for a banned exec queue,
handle_sched_done() calls wake_up_all() before
clear_exec_queue_pending_disable(). This creates a race with the
wait_event_timeout() in guc_exec_queue_timedout_job() that waits
for pending_disable to be cleared:

    smp_rmb();
    ret = wait_event_timeout(guc->ct.wq,
                 ...
                 ...);

This was observed as:
[drm:guc_exec_queue_timedout_job [xe]] Tile0: GT0: Check job timeout: seqno=4294967169, lrc_seqno=4294967169, guc_id=4, running_time_ms=0, timeout_ms=5000, diff=0x00000001

Moving the wake_up_all() (along with its smp_wmb())
after all paths that clear pending_disable, ensuring that waiters
always observe the updated state when woken.

Same as for runnable_state == 1 in the beginning of
handle_sched_done().

Signed-off-by: Jakub Legowski <jakub.legowski@intel.com>
---
 drivers/gpu/drm/xe/xe_guc_submit.c | 30 ++++++++++++++++--------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index 99d8c807ff05..a181b5042293 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -3239,25 +3239,27 @@ static void handle_sched_done(struct xe_guc *guc, struct xe_exec_queue *q,
 			clear_exec_queue_pending_disable(q);
 			suspend_fence_signal(q);
 		} else {
+			bool destroyed = exec_queue_destroyed(q);
+
+			/*
+			 * Make sure to clear the pending_disable only
+			 * after sampling the destroyed state. We want
+			 * to ensure we don't trigger the unregister too
+			 * early with something intending to only
+			 * disable scheduling. The caller doing the
+			 * destroy must wait for an ongoing
+			 * pending_disable before marking as destroyed.
+			 */
+			clear_exec_queue_pending_disable(q);
+
 			if (exec_queue_banned(q)) {
+				/* Pairs with smp_rmb in guc_exec_queue_timedout_job */
 				smp_wmb();
 				wake_up_all(&guc->ct.wq);
 			}
-			if (exec_queue_destroyed(q)) {
-				/*
-				 * Make sure to clear the pending_disable only
-				 * after sampling the destroyed state. We want
-				 * to ensure we don't trigger the unregister too
-				 * early with something intending to only
-				 * disable scheduling. The caller doing the
-				 * destroy must wait for an ongoing
-				 * pending_disable before marking as destroyed.
-				 */
-				clear_exec_queue_pending_disable(q);
+
+			if (destroyed)
 				deregister_exec_queue(guc, q);
-			} else {
-				clear_exec_queue_pending_disable(q);
-			}
 		}
 	}
 }
-- 
2.48.1

---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.

Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.