Re: [PATCH v4 3/3] drm/xe: Route execlist exec queue teardown off system_dfl_wq

[Matthew Brost <matthew.brost@intel.com>]

On Tue, Sep 29, 2026 at 04:29:10PM +0200, Thomas Hellström wrote:
> execlist_exec_queue_destroy() defers the final teardown of a struct
> xe_exec_queue (which calls drm_sched_fini()) to a work item queued on
> system_dfl_wq, a global, kernel-wide workqueue that xe has no control
> over and never waits on during module unload.
> 
> For exec queues without an associated xe_vm (e.g. GT-internal kernel
> queues, the GSC and OA kernel queues, and one PXP kernel queue), there
> is nothing else keeping the xe_device, and hence the module, alive
> while this work is queued or running: rmmod xe could succeed and free
> the module's text while execlist_exec_queue_destroy_async() is still
> queued or running on system_dfl_wq, jumping into freed code from
> drm_sched_fini() or the exec queue's own cleanup.
> 
> Fix this the same way GuC exec queue teardown already does it: take an
> explicit drm_device reference across the deferred teardown, and queue
> the work on xe_destroy_wq instead of system_dfl_wq, the module-lifetime
> workqueue that is guaranteed to be drained by
> xe_destroy_wq_module_exit() before the module can unload. Taking the
> reference explicitly, rather than relying on whatever reference an
> associated xe_vm may or may not be holding, keeps this exec queue's
> teardown self-contained and correct regardless of vm lifetime.
> 
> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

Side note - I'm planning on adding a CPU bind backend, once we that we
will have two functional queue backends and I think we can finally nuke
the execlist backend because at this point it just creates noise in
reviews from Sashiko.

Matt 

> Assisted-by: LLM
> ---
>  drivers/gpu/drm/xe/xe_execlist.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_execlist.c b/drivers/gpu/drm/xe/xe_execlist.c
> index a36db39dcda8..a6984999962d 100644
> --- a/drivers/gpu/drm/xe/xe_execlist.c
> +++ b/drivers/gpu/drm/xe/xe_execlist.c
> @@ -5,6 +5,7 @@
>  
>  #include "xe_execlist.h"
>  
> +#include <drm/drm_drv.h>
>  #include <drm/drm_managed.h>
>  
>  #include "instructions/xe_mi_commands.h"
> @@ -21,6 +22,7 @@
>  #include "xe_macros.h"
>  #include "xe_mmio.h"
>  #include "xe_mocs.h"
> +#include "xe_module.h"
>  #include "xe_ring_ops_types.h"
>  #include "xe_sched_job.h"
>  
> @@ -402,6 +404,7 @@ static void execlist_exec_queue_destroy_async(struct work_struct *w)
>  	spin_unlock_irqrestore(&exl->port->lock, flags);
>  
>  	xe_exec_queue_fini(q);
> +	drm_dev_put(&xe->drm);
>  }
>  
>  static void execlist_exec_queue_kill(struct xe_exec_queue *q)
> @@ -411,8 +414,9 @@ static void execlist_exec_queue_kill(struct xe_exec_queue *q)
>  
>  static void execlist_exec_queue_destroy(struct xe_exec_queue *q)
>  {
> +	drm_dev_get(&gt_to_xe(q->gt)->drm);
>  	INIT_WORK(&q->execlist->destroy_async, execlist_exec_queue_destroy_async);
> -	queue_work(system_dfl_wq, &q->execlist->destroy_async);
> +	xe_destroy_wq_queue(&q->execlist->destroy_async);
>  }
>  
>  static int execlist_exec_queue_set_priority(struct xe_exec_queue *q,
> -- 
> 2.55.0
>