5.4-stable patches

added patches:
	drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch

diff --git a/queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch b/queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch
new file mode 100644 (file)
index 0000000..36ea909
--- /dev/null
+++ b/queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch
@@ -0,0 +1,50 @@
+From 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Fri, 13 Jun 2025 14:20:13 -0700
+Subject: drm/sched: Increment job count before swapping tail spsc queue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee upstream.
+
+A small race exists between spsc_queue_push and the run-job worker, in
+which spsc_queue_push may return not-first while the run-job worker has
+already idled due to the job count being zero. If this race occurs, job
+scheduling stops, leading to hangs while waiting on the job’s DMA
+fences.
+
+Seal this race by incrementing the job count before appending to the
+SPSC queue.
+
+This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in
+an SVM test case.
+
+Fixes: 1b1f42d8fde4 ("drm: move amd_gpu_scheduler into common location")
+Fixes: 27105db6c63a ("drm/amdgpu: Add SPSC queue to scheduler.")
+Cc: stable@vger.kernel.org
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Link: https://lore.kernel.org/r/20250613212013.719312-1-matthew.brost@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/drm/spsc_queue.h |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/include/drm/spsc_queue.h
++++ b/include/drm/spsc_queue.h
+@@ -70,9 +70,11 @@ static inline bool spsc_queue_push(struc
+ 
+       preempt_disable();
+ 
++      atomic_inc(&queue->job_count);
++      smp_mb__after_atomic();
++
+       tail = (struct spsc_node **)atomic_long_xchg(&queue->tail, (long)&node->next);
+       WRITE_ONCE(*tail, node);
+-      atomic_inc(&queue->job_count);
+ 
+       /*
+        * In case of first element verify new node will be visible to the consumer

diff --git a/queue-5.4/series b/queue-5.4/series
index 7fb6fa4c873d819d9134f8452db633ab991f3d25..dc53444f781da0092f6b51edc0d5d7fcebfaf7b5 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -124,3 +124,4 @@ x86-mce-amd-fix-threshold-limit-reset.patch
 x86-mce-don-t-remove-sysfs-if-thresholding-sysfs-init-fails.patch
 x86-mce-make-sure-cmci-banks-are-cleared-during-shutdown-on-intel.patch
 pinctrl-qcom-msm-mark-certain-pins-as-invalid-for-interrupts.patch
+drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch