As we may queue addition requests from the submit fence, we may recurse into i9xx_submit_request() and write a future request's TAIL only to be then overwritten by the parent. Reorder the hw write before the signal so that any child fences that then submit fences are ordered correctly. Reported-by: Pavel Machek <pavel@xxxxxx> Reported-by: Josh Holland <anowlcalledjosh@xxxxxxxxx> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=99671 Fixes: d55ac5bf97c6 ("drm/i915: Defer transfer onto execution timeline to actual hw submission") Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> Cc: Tvrtko Ursulin <tvrtko.ursulin@xxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> # v4.10+ --- drivers/gpu/drm/i915/intel_ringbuffer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c index 4a864f8c9387..93cc7b001d0b 100644 --- a/drivers/gpu/drm/i915/intel_ringbuffer.c +++ b/drivers/gpu/drm/i915/intel_ringbuffer.c @@ -782,10 +782,10 @@ static void i9xx_submit_request(struct drm_i915_gem_request *request) { struct drm_i915_private *dev_priv = request->i915; - i915_gem_request_submit(request); - GEM_BUG_ON(!IS_ALIGNED(request->tail, 8)); I915_WRITE_TAIL(request->engine, request->tail); + + i915_gem_request_submit(request); } static void i9xx_emit_breadcrumb(struct drm_i915_gem_request *req, u32 *cs) -- 2.11.0