[PATCH] drm/i915/selftests: read the seqno before dropping the request

[PATCH] drm/i915/selftests: read the seqno before dropping the request

[Wentao Liang]

perf_mi_bb_start() waits for the request it has just submitted, drops the
reference taken with i915_request_get() and only then reads
rq->hwsp_seqno[].

i915_request_wait() returns as soon as the fence is signaled, which
happens in i915_request_retire() before it puts the request's initial
reference.  If retirement has already run, the put in this loop is the
last one and i915_request_put() frees the request, so the seqno is read
from an object that the SLAB_TYPESAFE_BY_RCU slab cache can already have
handed out to another user.

Sample the seqno while the reference is still held.

Fixes: 3c7a44bbbfa7 ("drm/i915/selftests: Perform some basic cycle counting of MI ops")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/i915/gt/selftest_engine_cs.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
index 5ffa5e30f419..1846f1c7e77e 100644
--- a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
@@ -196,11 +196,17 @@ static int perf_mi_bb_start(void *arg)
 
 			if (i915_request_wait(rq, 0, HZ / 5) < 0)
 				err = -EIO;
+
+			/*
+			 * The request can be freed as soon as its last
+			 * reference is dropped, so read the seqno first.
+			 */
+			if (!err)
+				cycles[i] = rq->hwsp_seqno[3] - rq->hwsp_seqno[2];
+
 			i915_request_put(rq);
 			if (err)
 				break;
-
-			cycles[i] = rq->hwsp_seqno[3] - rq->hwsp_seqno[2];
 		}
 		i915_vma_put(batch);
 		intel_engine_pm_put(engine);
-- 
2.34.1

Re: [PATCH] drm/i915/selftests: read the seqno before dropping the request

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:53:45 +0000, Wentao Liang wrote:
> perf_mi_bb_start() waits for the request it has just submitted, drops the
> reference taken with i915_request_get() and only then reads
> rq->hwsp_seqno[].
> 
> i915_request_wait() returns as soon as the fence is signaled, which
> happens in i915_request_retire() before it puts the request's initial
> reference.  If retirement has already run, the put in this loop is the
> last one and i915_request_put() frees the request, so the seqno is read
> from an object that the SLAB_TYPESAFE_BY_RCU slab cache can already have
> handed out to another user.
> 
> Sample the seqno while the reference is still held.
> 
> Fixes: 3c7a44bbbfa7 ("drm/i915/selftests: Perform some basic cycle counting of MI ops")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/gpu/drm/i915/gt/selftest_engine_cs.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

✗ LGCI.VerificationFailed: failure for drm/i915/selftests: read the seqno before dropping the request

[Patchwork]

== Series Details ==

Series: drm/i915/selftests: read the seqno before dropping the request
URL   : https://patchwork.freedesktop.org/series/177747/
State : failure

== Summary ==

Series author address 'vulab@iscas.ac.cn' is not on the allowlist, which prevents CI from being automatically triggered.
If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork.
Exception occurred during validation, bailing out!
Build URL: http://gfx-ci.igk.intel.com:8080/job/CI_PW_kernel/192077/ (on built-in)

Re: [PATCH] drm/i915/selftests: read the seqno before dropping the request

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/i915/selftests: rq->hwsp_seqno[] read after retire in perf_mi_bb_start()
--

commit 50caf80a061d2ff30673d4eea9e27e211c297b1d
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/i915/selftests: read the seqno before dropping the request

This commit moves the read of rq->hwsp_seqno[] in perf_mi_bb_start()
before i915_request_put(rq) so the request reference is held while
sampling the cycle counts.

> diff --git a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
> index 5ffa5e30f4192..1846f1c7e77ee 100644
> --- a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
> @@ -196,11 +196,17 @@ static int perf_mi_bb_start(void *arg)
>  
>  			if (i915_request_wait(rq, 0, HZ / 5) < 0)
>  				err = -EIO;
> +
> +			/*
> +			 * The request can be freed as soon as its last
> +			 * reference is dropped, so read the seqno first.
> +			 */
> +			if (!err)
> +				cycles[i] = rq->hwsp_seqno[3] - rq->hwsp_seqno[2];

[Severity: Medium]
Does holding a reference on rq prevent rq->hwsp_seqno from being
redirected away from the timeline HWSP when i915_request_retire() runs?

In the scenario described by the commit message, where
i915_request_retire() runs before or concurrently with
i915_request_wait() returning, i915_request_retire() calls
i915_request_mark_complete() before signaling rq->fence and dropping the
initial request reference:

drivers/gpu/drm/i915/i915_request.c:i915_request_retire() {
	...
	trace_i915_request_retire(rq);
	i915_request_mark_complete(rq);
	...
	if (!i915_request_signaled(rq)) {
		spin_lock_irq(&rq->lock);
		dma_fence_signal_locked(&rq->fence);
		spin_unlock_irq(&rq->lock);
	}
	...
	i915_request_put(rq);
}

And i915_request_mark_complete() rewrites rq->hwsp_seqno to point at the
64-bit rq->fence.seqno field inside struct dma_fence:

drivers/gpu/drm/i915/i915_request.h:
static inline void i915_request_mark_complete(struct i915_request *rq)
{
	WRITE_ONCE(rq->hwsp_seqno, /* decouple from HWSP */
		   (u32 *)&rq->fence.seqno);
}

Once i915_request_mark_complete() has executed, indexing
rq->hwsp_seqno[2] and rq->hwsp_seqno[3] in perf_mi_bb_start() reads out
of bounds past rq->fence.seqno into adjacent fields of struct dma_fence
(rq->fence.flags and rq->fence.refcount) rather than reading the
timestamps written by write_timestamp(rq, 2) and write_timestamp(rq, 3)
in the timeline HWSP.

Should perf_mi_bb_start() save const u32 *hwsp = rq->hwsp_seqno before
calling i915_request_add(rq) (similar to __live_rc6_ctx() in
drivers/gpu/drm/i915/gt/selftest_rc6.c), or read from
ce->timeline->hwsp_seqno directly?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104025345.1527509-1-vulab@iscas.ac.cn?part=1