[PATCH] drm/i915: Fix write-read race with multiple rings

[PATCH] drm/i915: Fix write-read race with multiple rings

[Chris Wilson]

Daniel noticed a problem where is we wrote to an object with ring A in
the middle of a very long running batch, then executed a quick batch on
ring B before a batch that reads from the same object, its obj->ring would
now point to ring B, but its last_write_seqno would be still relative to
ring A. This would allow for the user to read from the object before the
GPU had completed the write, as set_domain would only check that ring B
had passed the last_write_seqno.

To fix this simply (and inelegantly), we bump the last_write_seqno when
switching rings so that the last_write_seqno is always relative to the
current obj->ring.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable@vger.kernel.org
---
 drivers/gpu/drm/i915/i915_gem.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 774620d..7c59cb1 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1954,6 +1954,10 @@ i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
 	u32 seqno = intel_ring_get_seqno(ring);
 
 	BUG_ON(ring == NULL);
+	if (obj->ring != ring && obj->last_write_seqno) {
+		/* Keep the seqno relative to the current ring */
+		obj->last_write_seqno = seqno;
+	}
 	obj->ring = ring;
 
 	/* Add a reference if we're newly entering the active list. */
-- 
1.8.3.2

Re: [PATCH] drm/i915: Fix write-read race with multiple rings

[Daniel Vetter]

On Tue, Jul 09, 2013 at 09:22:39AM +0100, Chris Wilson wrote:
> Daniel noticed a problem where is we wrote to an object with ring A in
> the middle of a very long running batch, then executed a quick batch on
> ring B before a batch that reads from the same object, its obj->ring would
> now point to ring B, but its last_write_seqno would be still relative to
> ring A. This would allow for the user to read from the object before the
> GPU had completed the write, as set_domain would only check that ring B
> had passed the last_write_seqno.
> 
> To fix this simply (and inelegantly), we bump the last_write_seqno when
> switching rings so that the last_write_seqno is always relative to the
> current obj->ring.
> 
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: stable@vger.kernel.org

It was a bit trick, but I've stitched together an igt to exercise this
bug. Picked up for -fixes, thanks for the patch.
-Daniel

> ---
>  drivers/gpu/drm/i915/i915_gem.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index 774620d..7c59cb1 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -1954,6 +1954,10 @@ i915_gem_object_move_to_active(struct drm_i915_gem_object *obj,
>  	u32 seqno = intel_ring_get_seqno(ring);
>  
>  	BUG_ON(ring == NULL);
> +	if (obj->ring != ring && obj->last_write_seqno) {
> +		/* Keep the seqno relative to the current ring */
> +		obj->last_write_seqno = seqno;
> +	}
>  	obj->ring = ring;
>  
>  	/* Add a reference if we're newly entering the active list. */
> -- 
> 1.8.3.2
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch