Re: [PATCH v7 21/24] drm/xe: Add ULLS migration job support to GuC submission

[Matthew Brost <matthew.brost@intel.com>]

On Fri, Sep 25, 2026 at 06:48:57AM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] drm/xe: TOCTOU race in ULLS migration job prefetching leads to stale command execution
> --
> 
> commit 231db353d11582f236795322ee38df1ad9cad0d1
> Author: Matthew Brost <matthew.brost@intel.com>
> drm/xe: Add ULLS migration job support to GuC submission
> 
> This commit adds Ultra Low Latency Submission (ULLS) migration job support to
> the GuC submission backend. It introduces optimizations for chained ULLS jobs
> by having the GPU publish its own ring tail and suppressing the CPU's RING_TAIL
> MMIO updates.
> 
> > diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
> > index a2784763e72ba..cd9bb9f9e28c8 100644
> > --- a/drivers/gpu/drm/xe/xe_guc_submit.c
> > +++ b/drivers/gpu/drm/xe/xe_guc_submit.c
> > @@ -1190,9 +1190,10 @@ static void submit_exec_queue(struct xe_exec_queue *q, struct xe_sched_job *job)
> >  	xe_gt_assert(guc_to_gt(guc), exec_queue_registered(q));
> >  
> >  	if (!job->restore_replay || job->last_replay) {
> > +		/* A ULLS job past the first publishes its own ring tail */
> >  		if (xe_exec_queue_is_parallel(q))
> >  			wq_item_append(q);
> > -		else
> > +		else if (!xe_sched_job_ulls_is_chained(job))
> >  			xe_lrc_set_ring_tail(lrc, lrc->ring.tail);
> 
> [Severity: High]

Not observed in testing - semaphore wait acts as prefetch barrier.
Before semaphore release all CPU writes are GPU visable.

Matt 

> Does skipping the RING_TAIL MMIO write here expose a race condition where the
> GPU could execute stale ring buffer memory?
> 
> For ULLS chained jobs, the GPU advances the tail via MI_LRI prior to executing
> MI_SEMAPHORE_WAIT, which happens in emit_ulls_postamble():
> 
> drivers/gpu/drm/xe/xe_ring_ops.c:emit_ulls_postamble()
> 	i = emit_ulls_ring_tail(gt, lrc, dw, i, head);
> 	dw[i++] = MI_SEMAPHORE_WAIT | ...
> 
> Because the CPU intentionally skips the xe_lrc_set_ring_tail() MMIO write for
> these chained jobs, the hardware mechanism that normally invalidates the GPU's
> instruction cache is bypassed. 
> 
> Could the Command Streamer fetch unit see the advanced RING_TAIL and prefetch
> memory for the next job before the CPU has actually written it to the ring
> buffer? If the CPU hasn't populated the commands yet, when the CPU finally
> writes the next job and signals the semaphore, it appears the GPU might wake up
> and execute the stale prefetched instructions from its internal cache rather
> than the newly written migration commands.
> 
> [ ... ]
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260925045320.1325860-1-matthew.brost@intel.com?part=21