Re: [PATCH v3 3/3] CI-ONLY:Defer VM teardown until exec queue cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] drm/xe: deferred VM teardown from xe_file_close() outlives
  xe_pci_remove()
- [Medium] drm/xe: skipping xe_exec_queue_kill() in
  xe_exec_queue_destroy_ioctl() stalls ufence waiters
--

commit a757927452b3070c5b807d334d20880cf0550808
Author: Arvind Yadav <arvind.yadav@intel.com>

CI-ONLY:Defer VM teardown until exec queue cleanup

This commit tracks user exec queues and user-created bind queues on the
VM until final queue destruction, deferring VM teardown if tracked queues
remain when the VM is destroyed or the DRM file is closed.

> diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
> index 1ef9e276bbcad..f632398f59c94 100644
> --- a/drivers/gpu/drm/xe/xe_device.c
> +++ b/drivers/gpu/drm/xe/xe_device.c
> @@ -177,6 +177,7 @@ static void xe_file_close(struct drm_device *dev, struct drm_file *file)
>  	struct xe_file *xef = file->driver_priv;
>  	struct xe_vm *vm;
>  	struct xe_exec_queue *q;
> +	bool close_deferred = false;
>  	unsigned long idx;
>  
>  	guard(xe_pm_runtime)(xe);
> @@ -194,11 +195,26 @@ static void xe_file_close(struct drm_device *dev, struct drm_file *file)
>  	xa_for_each(&xef->exec_queue.xa, idx, q) {
>  		if (q->vm && q->hwe->hw_engine_group)
>  			xe_hw_engine_group_del_exec_queue(q->hwe->hw_engine_group, q);
> -		xe_exec_queue_kill(q);
> +		/*
> +		 * Killing a bind queue can force pending PT jobs to clear
> +		 * mappings while hardware exec queues are still running.
> +		 * Let bind jobs drain before their queue is destroyed.
> +		 */
> +		if (!(q->flags & EXEC_QUEUE_FLAG_VM))
> +			xe_exec_queue_kill(q);
>  		xe_exec_queue_put(q);
>  	}
> +
> +	/*
> +	 * The scheduling-disable wait above remains synchronous. Defer VM
> +	 * close if tracked queues still await final destruction.
> +	 */
>  	xa_for_each(&xef->vm.xa, idx, vm)
> -		xe_vm_close_and_put(vm);
> +		close_deferred |= xe_vm_close_and_put_deferred(vm);

[Severity: High]
Can deferring VM close in xe_file_close() allow VM teardown to outlive
xe_pci_remove()?

xe_exec_queue_kill() and xe_exec_queue_put() do not wait synchronously in
xe_file_close(); they queue TDR and cleanup work onto gt->ordered_wq,
which then queues q->guc->destroy_async onto xe_destroy_wq.  Only when
__xe_exec_queue_free() runs there does xe_vm_remove_close_queue() queue
vm->close.work onto xe_destroy_wq, and vm_close_work_func() then kills
vm->q, starting another round of gt->ordered_wq and xe_destroy_wq work
before vm->destroy_work is finally queued.

If the PCI device is unbound or hot-unplugged after the DRM file is
closed, xe_pci_remove() runs xe_bo_pci_dev_remove_all() while the deferred
VM is still open, and xe_destroy_wq_flush() only calls flush_workqueue()
once without draining gt->ordered_wq or the chained work items.
xe_pci_remove() then finishes xe_pm_fini() and devres_release_all()
unmaps tile->mem.vram->mapping while the VM still has pinned page-table
BOs and active DMA mappings, allowing MMU invalidation notifiers to write
to unmapped VRAM BARs in xe_pt_zap_ptes_entry() and later worker stages to
call runtime PM helpers after xe_pm_fini().

[ ... ]

> diff --git a/drivers/gpu/drm/xe/xe_exec_queue.c b/drivers/gpu/drm/xe/xe_exec_queue.c
> index 7ade915c59a85..c9b3909b6327c 100644
> --- a/drivers/gpu/drm/xe/xe_exec_queue.c
> +++ b/drivers/gpu/drm/xe/xe_exec_queue.c
[ ... ]
> @@ -1657,7 +1670,12 @@ int xe_exec_queue_destroy_ioctl(struct drm_device *dev, void *data,
>  	if (q->vm && q->hwe->hw_engine_group)
>  		xe_hw_engine_group_del_exec_queue(q->hwe->hw_engine_group, q);
>  
> -	xe_exec_queue_kill(q);
> +	/*
> +	 * Let bind jobs drain. Killing their queue can turn pending PT binds
> +	 * into PTE clears while hardware queues still use the VM.
> +	 */
> +	if (!(q->flags & EXEC_QUEUE_FLAG_VM))
> +		xe_exec_queue_kill(q);
>  
>  	trace_xe_exec_queue_close(q);
>  	xe_exec_queue_put(q);

[Severity: Medium]
Can skipping xe_exec_queue_kill() here stall a thread waiting in
xe_wait_user_fence_ioctl() on a user-created bind queue?

When a thread waits on an unsignaled user fence with args->exec_queue_id
set to a DRM_XE_ENGINE_CLASS_VM_BIND queue, xe_wait_user_fence_ioctl()
holds a lookup reference on q and sleeps on xe->ufence_wq until the fence
signals or q->ops->reset_status(q) becomes non-zero.  Because user bind
queues have EXEC_QUEUE_FLAG_VM set, skipping xe_exec_queue_kill() when
another thread calls xe_exec_queue_destroy_ioctl() leaves the queue
unkilled (so reset_status() stays 0) and skips waking xe->ufence_wq, while
the waiter's reference on q prevents xe_exec_queue_put() from freeing the
queue.

As a result, the waiter does not abort with -EIO and keeps q pinned, which
also leaves xef->exec_queue.pending_removal non-zero (hanging fdinfo
readers in wait_var_event() in show_run_ticks()) and blocks deferred VM
teardown.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115085518.1135138-1-arvind.yadav@intel.com?part=3