[Intel-gfx] [PATCH v3] drm/i915: add guard page to ggtt->error_capture

[Andi Shyti]

Hi Andrzej,

On Mon, Feb 06, 2023 at 10:03:27AM +0100, Andrzej Hajda wrote:
> Write-combining memory allows speculative reads by CPU.
> ggtt->error_capture is WC mapped to CPU, so CPU/MMU can try
> to prefetch memory beyond the error_capture, ie it tries
> to read memory pointed by next PTE in GGTT.
> If this PTE points to invalid address DMAR errors will occur.
> This behaviour was observed on ADL, RPL, DG2 platforms.
> To avoid it, guard scratch page should be added after error_capture.
> 
> Signed-off-by: Andrzej Hajda <andrzej.hajda at intel.com>

Reviewed-by: Andi Shyti <andi.shyti at linux.intel.com>

Thanks,
Andi

> ---
> This patch tries to diminish plague of DMAR read errors present
> in CI for ADL*, RPL*, DG2 platforms, see for example [1] (grep DMAR).
> CI is usually tolerant for these errors, so the scale of the problem
> is not really visible.
> To show it I have counted lines containing DMAR read errors in dmesgs
> produced by CI for all three versions of the patch, but in contrast to v2
> I have grepped only for lines containing "PTE Read access".
> Below stats for kernel w/o patch vs patched one.
> v1: 210 vs 0
> v2: 201 vs 0
> v3: 214 vs 0
> Apparently the patch fixes all common PTE read errors.
> 
> In previous version there were different numbers due to less exact grepping,
> "grep DMAR" catched write errors and "DMAR: DRHD: handling fault status reg"
> lines, anyway the actual number of errors is much bigger - DMAR errors
> are rate-limited.
> 
> [1]: http://gfx-ci.igk.intel.com/tree/drm-tip/CI_DRM_12678/bat-adln-1/dmesg0.txt
> 
> Changelog:
> v2:
>     - modified commit message (I hope the diagnosis is correct),
>     - added bug checks to ensure scratch is initialized on gen3 platforms.
>       CI produces strange stacktrace for it suggesting scratch[0] is NULL,
>       to be removed after resolving the issue with gen3 platforms.
> v3:
>     - removed bug checks, replaced with gen check.
> 
> Regards
> Andrzej
> ---
>  drivers/gpu/drm/i915/gt/intel_ggtt.c | 30 +++++++++++++++++++++++++---
>  1 file changed, 27 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gt/intel_ggtt.c b/drivers/gpu/drm/i915/gt/intel_ggtt.c
> index 842e69c7b21e49..15eb2d4158d679 100644
> --- a/drivers/gpu/drm/i915/gt/intel_ggtt.c
> +++ b/drivers/gpu/drm/i915/gt/intel_ggtt.c
> @@ -503,6 +503,13 @@ static void cleanup_init_ggtt(struct i915_ggtt *ggtt)
>  	mutex_destroy(&ggtt->error_mutex);
>  }
>  
> +static void ggtt_insert_scratch_page(struct i915_ggtt *ggtt, u64 offset)
> +{
> +	struct i915_address_space *vm = &ggtt->vm;
> +
> +	vm->insert_page(vm, px_dma(vm->scratch[0]), offset, I915_CACHE_NONE, 0);
> +}
> +
>  static int init_ggtt(struct i915_ggtt *ggtt)
>  {
>  	/*
> @@ -553,6 +560,13 @@ static int init_ggtt(struct i915_ggtt *ggtt)
>  		 * bug, which we expect to cause other failures...
>  		 */
>  		ggtt->error_capture.size = I915_GTT_PAGE_SIZE;
> +		/*
> +		 * Since CPU can perform speculative reads on error capture
> +		 * (write-combining allows it) and since gen12 it really happens
> +		 * add scratch page after error capture to avoid DMAR errors.
> +		 */
> +		if (GRAPHICS_VER(ggtt->vm.i915) >= 12)
> +			ggtt->error_capture.size += I915_GTT_PAGE_SIZE;
>  		ggtt->error_capture.color = I915_COLOR_UNEVICTABLE;
>  		if (drm_mm_reserve_node(&ggtt->vm.mm, &ggtt->error_capture))
>  			drm_mm_insert_node_in_range(&ggtt->vm.mm,
> @@ -562,11 +576,21 @@ static int init_ggtt(struct i915_ggtt *ggtt)
>  						    0, ggtt->mappable_end,
>  						    DRM_MM_INSERT_LOW);
>  	}
> -	if (drm_mm_node_allocated(&ggtt->error_capture))
> +	if (drm_mm_node_allocated(&ggtt->error_capture)) {
> +		u64 start = ggtt->error_capture.start;
> +		u64 end = ggtt->error_capture.start + ggtt->error_capture.size;
> +		u64 i;
> +
> +		/*
> +		 * During error capture, memcpying from the GGTT is triggering a
> +		 * prefetch of the following PTE, so fill it with a guard page.
> +		 */
> +		for (i = start + I915_GTT_PAGE_SIZE; i < end; i += I915_GTT_PAGE_SIZE)
> +			ggtt_insert_scratch_page(ggtt, i);
>  		drm_dbg(&ggtt->vm.i915->drm,
>  			"Reserved GGTT:[%llx, %llx] for use by error capture\n",
> -			ggtt->error_capture.start,
> -			ggtt->error_capture.start + ggtt->error_capture.size);
> +			start, end);
> +	}
>  
>  	/*
>  	 * The upper portion of the GuC address space has a sizeable hole
> -- 
> 2.34.1