From 97bea307967ac1ced7e818f0dcce84b43c4e206c Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 12 Jul 2025 16:36:31 +0200 Subject: [PATCH] 5.4-stable patches added patches: drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch --- ...ount-before-swapping-tail-spsc-queue.patch | 50 +++++++++++++++++++ queue-5.4/series | 1 + 2 files changed, 51 insertions(+) create mode 100644 queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch diff --git a/queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch b/queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch new file mode 100644 index 0000000000..36ea90986e --- /dev/null +++ b/queue-5.4/drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch @@ -0,0 +1,50 @@ +From 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Fri, 13 Jun 2025 14:20:13 -0700 +Subject: drm/sched: Increment job count before swapping tail spsc queue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +commit 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee upstream. + +A small race exists between spsc_queue_push and the run-job worker, in +which spsc_queue_push may return not-first while the run-job worker has +already idled due to the job count being zero. If this race occurs, job +scheduling stops, leading to hangs while waiting on the job’s DMA +fences. + +Seal this race by incrementing the job count before appending to the +SPSC queue. + +This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in +an SVM test case. + +Fixes: 1b1f42d8fde4 ("drm: move amd_gpu_scheduler into common location") +Fixes: 27105db6c63a ("drm/amdgpu: Add SPSC queue to scheduler.") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Jonathan Cavitt +Link: https://lore.kernel.org/r/20250613212013.719312-1-matthew.brost@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + include/drm/spsc_queue.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/include/drm/spsc_queue.h ++++ b/include/drm/spsc_queue.h +@@ -70,9 +70,11 @@ static inline bool spsc_queue_push(struc + + preempt_disable(); + ++ atomic_inc(&queue->job_count); ++ smp_mb__after_atomic(); ++ + tail = (struct spsc_node **)atomic_long_xchg(&queue->tail, (long)&node->next); + WRITE_ONCE(*tail, node); +- atomic_inc(&queue->job_count); + + /* + * In case of first element verify new node will be visible to the consumer diff --git a/queue-5.4/series b/queue-5.4/series index 7fb6fa4c87..dc53444f78 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -124,3 +124,4 @@ x86-mce-amd-fix-threshold-limit-reset.patch x86-mce-don-t-remove-sysfs-if-thresholding-sysfs-init-fails.patch x86-mce-make-sure-cmci-banks-are-cleared-during-shutdown-on-intel.patch pinctrl-qcom-msm-mark-certain-pins-as-invalid-for-interrupts.patch +drm-sched-increment-job-count-before-swapping-tail-spsc-queue.patch -- 2.47.2