Commit 07cf4b86 authored by Tomasz Lis's avatar Tomasz Lis Committed by Matthew Brost
Browse files

drm/xe: Protect against unset LRC when pausing submissions 



While pausing submissions, it is possible to encouner an exec queue
which is during creation, and therefore doesn't have a valid xe_lrc
struct reference.

Protect agains such situation, by checking for NULL before access.

Reviewed-by: default avatarMatthew Brost <matthew.brost@intel.com>
Fixes: c25c1010 ("drm/xe/vf: Replay GuC submission state on pause / unpause")
Signed-off-by: default avatarTomasz Lis <tomasz.lis@intel.com>
Signed-off-by: default avatarMatthew Brost <matthew.brost@intel.com>
Link: https://patch.msgid.link/20251124222853.1900800-1-tomasz.lis@intel.com
parent 00937fe1

drivers/gpu/drm/xe/xe_guc_submit.c

+16 −6
Original line number Diff line number Diff line
@@ -2107,6 +2107,18 @@ static void guc_exec_queue_revert_pending_state_change(struct xe_guc *guc, 
	q->guc->resume_time = 0;

}



static void lrc_parallel_clear(struct xe_lrc *lrc)

{

	struct xe_device *xe = gt_to_xe(lrc->gt);

	struct iosys_map map = xe_lrc_parallel_map(lrc);

	int i;



	for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)

		parallel_write(xe, map, wq[i],

			       FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |

			       FIELD_PREP(WQ_LEN_MASK, 0));

}



/*

 * This function is quite complex but only real way to ensure no state is lost

 * during VF resume flows. The function scans the queue state, make adjustments
@@ -2130,8 +2142,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q) 
	guc_exec_queue_revert_pending_state_change(guc, q);



	if (xe_exec_queue_is_parallel(q)) {

		struct xe_device *xe = guc_to_xe(guc);

		struct iosys_map map = xe_lrc_parallel_map(q->lrc[0]);

		/* Pairs with WRITE_ONCE in __xe_exec_queue_init  */

		struct xe_lrc *lrc = READ_ONCE(q->lrc[0]);



		/*

		 * NOP existing WQ commands that may contain stale GGTT
@@ -2139,10 +2151,8 @@ static void guc_exec_queue_pause(struct xe_guc *guc, struct xe_exec_queue *q) 
		 * seems to get confused if the WQ head/tail pointers are

		 * adjusted.

		 */

		for (i = 0; i < WQ_SIZE / sizeof(u32); ++i)

			parallel_write(xe, map, wq[i],

				       FIELD_PREP(WQ_TYPE_MASK, WQ_TYPE_NOOP) |

				       FIELD_PREP(WQ_LEN_MASK, 0));

		if (lrc)

			lrc_parallel_clear(lrc);

	}



	job = xe_sched_first_pending_job(sched);