Re: [PATCH v7 21/24] drm/xe: Add ULLS migration job support to GuC submission

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe: TOCTOU race in ULLS migration job prefetching leads to stale command execution
--

commit 231db353d11582f236795322ee38df1ad9cad0d1
Author: Matthew Brost <matthew.brost@intel.com>
drm/xe: Add ULLS migration job support to GuC submission

This commit adds Ultra Low Latency Submission (ULLS) migration job support to
the GuC submission backend. It introduces optimizations for chained ULLS jobs
by having the GPU publish its own ring tail and suppressing the CPU's RING_TAIL
MMIO updates.

> diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
> index a2784763e72ba..cd9bb9f9e28c8 100644
> --- a/drivers/gpu/drm/xe/xe_guc_submit.c
> +++ b/drivers/gpu/drm/xe/xe_guc_submit.c
> @@ -1190,9 +1190,10 @@ static void submit_exec_queue(struct xe_exec_queue *q, struct xe_sched_job *job)
>  	xe_gt_assert(guc_to_gt(guc), exec_queue_registered(q));
>  
>  	if (!job->restore_replay || job->last_replay) {
> +		/* A ULLS job past the first publishes its own ring tail */
>  		if (xe_exec_queue_is_parallel(q))
>  			wq_item_append(q);
> -		else
> +		else if (!xe_sched_job_ulls_is_chained(job))
>  			xe_lrc_set_ring_tail(lrc, lrc->ring.tail);

[Severity: High]
Does skipping the RING_TAIL MMIO write here expose a race condition where the
GPU could execute stale ring buffer memory?

For ULLS chained jobs, the GPU advances the tail via MI_LRI prior to executing
MI_SEMAPHORE_WAIT, which happens in emit_ulls_postamble():

drivers/gpu/drm/xe/xe_ring_ops.c:emit_ulls_postamble()
	i = emit_ulls_ring_tail(gt, lrc, dw, i, head);
	dw[i++] = MI_SEMAPHORE_WAIT | ...

Because the CPU intentionally skips the xe_lrc_set_ring_tail() MMIO write for
these chained jobs, the hardware mechanism that normally invalidates the GPU's
instruction cache is bypassed. 

Could the Command Streamer fetch unit see the advanced RING_TAIL and prefetch
memory for the next job before the CPU has actually written it to the ring
buffer? If the CPU hasn't populated the commands yet, when the CPU finally
writes the next job and signals the semaphore, it appears the GPU might wake up
and execute the stale prefetched instructions from its internal cache rather
than the newly written migration commands.

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925045320.1325860-1-matthew.brost@intel.com?part=21