Re: [PATCH v2 1/2] drm/xe/vf: Late fixups of LRCs after VF migration

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] drm/xe/vf: premature mutex_destroy() of scratch_lock in
  vf_migration_fini()
--

commit 3d0fd68d1f87ea2f30e131438f2016a4f50af378
Author: Tomasz Lis <tomasz.lis@intel.com>

drm/xe/vf: Late fixups of LRCs after VF migration

This commit moves VF LRC HWSP rebasing from the post-migration recovery
worker to exec queue registration and unpause preparation, protecting the
shared migration scratch buffer with a mutex.

> diff --git a/drivers/gpu/drm/xe/xe_gt_sriov_vf.c b/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> index 2a5f2064ad3e8..f8c03b741b084 100644
> --- a/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
> +++ b/drivers/gpu/drm/xe/xe_gt_sriov_vf.c
[ ... ]
> @@ -1488,6 +1484,7 @@ static void vf_migration_fini(void *arg)
>  	spin_unlock_irq(&gt->sriov.vf.migration.lock);
>  
>  	cancel_work_sync(&gt->sriov.vf.migration.worker);
> +	mutex_destroy(&gt->sriov.vf.migration.scratch_lock);
>  }
>  
>  /**
> @@ -1509,6 +1506,7 @@ int xe_gt_sriov_vf_init_early(struct xe_gt *gt)
>  	if (!buf)
>  		return -ENOMEM;
>  
> +	mutex_init(&gt->sriov.vf.migration.scratch_lock);
>  	gt->sriov.vf.migration.scratch = buf;

[Severity: Medium]
Can vf_migration_fini() destroy scratch_lock while GuC DRM scheduler
workers are still registering exec queues?

xe_gt_sriov_vf_init() registers vf_migration_fini() with devm at the end
of xe_gt_init(), after xe_guc_submit_init() registers guc_submit_fini().
During device unbind or unload, devres runs vf_migration_fini() before
guc_submit_fini() stops the GuC schedulers:

CPU0                              CPU1 (DRM sched worker)
vf_migration_fini()
  cancel_work_sync(&...worker)
  mutex_destroy(&...scratch_lock)
                                  guc_exec_queue_run_job()
                                    register_exec_queue()
                                      xe_exec_queue_lrcs_hwsp_rebase()
                                        mutex_lock(&...scratch_lock)
                                          <-- locks destroyed mutex
guc_submit_fini()

Also, if probe fails between xe_gt_sriov_vf_init_early() and
xe_gt_sriov_vf_init(), vf_migration_fini() is never registered and
scratch_lock is not destroyed.  Initializing scratch_lock with
drmm_mutex_init() in xe_gt_sriov_vf_init_early() would match the drmm
lifetime of migration.scratch and guc->submission_state.lock.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106155615.977330-1-tomasz.lis@intel.com?part=1