* [PATCH v1] drm/xe: Protect against unset LRC when pausing submissions
@ 2025-11-24 21:23 Tomasz Lis
2025-11-24 21:51 ` Matthew Brost
0 siblings, 1 reply; 3+ messages in thread
From: Tomasz Lis @ 2025-11-24 21:23 UTC (permalink / raw)
To: intel-xe
Cc: Matthew Brost, Michał Winiarski, Michał Wajdeczko,
Piotr Piórkowski, Satyanarayana K V P
While pausing submissions, it is possible to encouner an exec queue
which is during creation, and therefore doesn't have a valid xe_lrc
struct reference.
Protect agains such situation, by checking for NULL before access.
Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
---
drivers/gpu/drm/xe/xe_guc_submit.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index 7e0882074a99..f57000c2cb9d 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -2107,6 +2107,18 @@ static void guc_exec_queue_revert_pending_state_change(struct xe_guc *guc,
q->guc->resume_time = 0;
}
+static void lrc_parallel_clear(struct xe_lrc *lrc)
+{
+ struct xe_device *xe = gt_to_xe(lrc->gt);
+ struct iosys_map map = xe_lrc_parallel_map(lrc);
+ int i;
+
+ for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)
+ parallel_write(xe, map, wq[i],
+ FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |
+ FIELD_PREP(WQ_LEN_MASK, 0));
+}
+
/*
* This function is quite complex but only real way to ensure no state is lost
* during VF resume flows. The function scans the queue state, make adjustments
@@ -2130,8 +2142,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q)
guc_exec_queue_revert_pending_state_change(guc, q);
if (xe_exec_queue_is_parallel(q)) {
- struct xe_device *xe = guc_to_xe(guc);
- struct iosys_map map = xe_lrc_parallel_map(q->lrc[0]);
+ /* Pairs with WRITE_ONCE in __xe_exec_queue_init */
+ struct xe_lrc *lrc = READ_ONCE(q->lrc[0]);
/*
* NOP existing WQ commands that may contain stale GGTT
@@ -2139,10 +2151,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q)
* seems to get confused if the WQ head/tail pointers are
* adjusted.
*/
- for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)
- parallel_write(xe, map, wq[i],
- FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |
- FIELD_PREP(WQ_LEN_MASK, 0));
+ if (lrc)
+ lrc_parallel_clear(lrc);
}
job = xe_sched_first_pending_job(sched);
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH v1] drm/xe: Protect against unset LRC when pausing submissions
2025-11-24 21:23 [PATCH v1] drm/xe: Protect against unset LRC when pausing submissions Tomasz Lis
@ 2025-11-24 21:51 ` Matthew Brost
0 siblings, 0 replies; 3+ messages in thread
From: Matthew Brost @ 2025-11-24 21:51 UTC (permalink / raw)
To: Tomasz Lis
Cc: intel-xe, Michał Winiarski, Michał Wajdeczko,
Piotr Piórkowski, Satyanarayana K V P
On Mon, Nov 24, 2025 at 10:23:25PM +0100, Tomasz Lis wrote:
> While pausing submissions, it is possible to encouner an exec queue
> which is during creation, and therefore doesn't have a valid xe_lrc
> struct reference.
>
> Protect agains such situation, by checking for NULL before access.
>
Fixes tag?
> Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
Otherwise LGTM:
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
> ---
> drivers/gpu/drm/xe/xe_guc_submit.c | 22 ++++++++++++++++------
> 1 file changed, 16 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
> index 7e0882074a99..f57000c2cb9d 100644
> --- a/drivers/gpu/drm/xe/xe_guc_submit.c
> +++ b/drivers/gpu/drm/xe/xe_guc_submit.c
> @@ -2107,6 +2107,18 @@ static void guc_exec_queue_revert_pending_state_change(struct xe_guc *guc,
> q->guc->resume_time = 0;
> }
>
> +static void lrc_parallel_clear(struct xe_lrc *lrc)
> +{
> + struct xe_device *xe = gt_to_xe(lrc->gt);
> + struct iosys_map map = xe_lrc_parallel_map(lrc);
> + int i;
> +
> + for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)
> + parallel_write(xe, map, wq[i],
> + FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |
> + FIELD_PREP(WQ_LEN_MASK, 0));
> +}
> +
> /*
> * This function is quite complex but only real way to ensure no state is lost
> * during VF resume flows. The function scans the queue state, make adjustments
> @@ -2130,8 +2142,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q)
> guc_exec_queue_revert_pending_state_change(guc, q);
>
> if (xe_exec_queue_is_parallel(q)) {
> - struct xe_device *xe = guc_to_xe(guc);
> - struct iosys_map map = xe_lrc_parallel_map(q->lrc[0]);
> + /* Pairs with WRITE_ONCE in __xe_exec_queue_init */
> + struct xe_lrc *lrc = READ_ONCE(q->lrc[0]);
>
> /*
> * NOP existing WQ commands that may contain stale GGTT
> @@ -2139,10 +2151,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q)
> * seems to get confused if the WQ head/tail pointers are
> * adjusted.
> */
> - for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)
> - parallel_write(xe, map, wq[i],
> - FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |
> - FIELD_PREP(WQ_LEN_MASK, 0));
> + if (lrc)
> + lrc_parallel_clear(lrc);
> }
>
> job = xe_sched_first_pending_job(sched);
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH v1] drm/xe: Protect against unset LRC when pausing submissions
@ 2025-11-24 22:28 Tomasz Lis
0 siblings, 0 replies; 3+ messages in thread
From: Tomasz Lis @ 2025-11-24 22:28 UTC (permalink / raw)
To: intel-xe
Cc: Matthew Brost, Michał Winiarski, Michał Wajdeczko,
Piotr Piórkowski, Satyanarayana K V P
While pausing submissions, it is possible to encouner an exec queue
which is during creation, and therefore doesn't have a valid xe_lrc
struct reference.
Protect agains such situation, by checking for NULL before access.
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Fixes: c25c1010df88 ("drm/xe/vf: Replay GuC submission state on pause / unpause")
Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
---
drivers/gpu/drm/xe/xe_guc_submit.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
index 7e0882074a99..f57000c2cb9d 100644
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -2107,6 +2107,18 @@ static void guc_exec_queue_revert_pending_state_change(struct xe_guc *guc,
q->guc->resume_time = 0;
}
+static void lrc_parallel_clear(struct xe_lrc *lrc)
+{
+ struct xe_device *xe = gt_to_xe(lrc->gt);
+ struct iosys_map map = xe_lrc_parallel_map(lrc);
+ int i;
+
+ for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)
+ parallel_write(xe, map, wq[i],
+ FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |
+ FIELD_PREP(WQ_LEN_MASK, 0));
+}
+
/*
* This function is quite complex but only real way to ensure no state is lost
* during VF resume flows. The function scans the queue state, make adjustments
@@ -2130,8 +2142,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q)
guc_exec_queue_revert_pending_state_change(guc, q);
if (xe_exec_queue_is_parallel(q)) {
- struct xe_device *xe = guc_to_xe(guc);
- struct iosys_map map = xe_lrc_parallel_map(q->lrc[0]);
+ /* Pairs with WRITE_ONCE in __xe_exec_queue_init */
+ struct xe_lrc *lrc = READ_ONCE(q->lrc[0]);
/*
* NOP existing WQ commands that may contain stale GGTT
@@ -2139,10 +2151,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q)
* seems to get confused if the WQ head/tail pointers are
* adjusted.
*/
- for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)
- parallel_write(xe, map, wq[i],
- FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |
- FIELD_PREP(WQ_LEN_MASK, 0));
+ if (lrc)
+ lrc_parallel_clear(lrc);
}
job = xe_sched_first_pending_job(sched);
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-11-24 22:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-11-24 21:23 [PATCH v1] drm/xe: Protect against unset LRC when pausing submissions Tomasz Lis
2025-11-24 21:51 ` Matthew Brost
-- strict thread matches above, loose matches on Subject: below --
2025-11-24 22:28 Tomasz Lis
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox