Re: [Intel-gfx] [PATCH 1/2] drm/i915/migrate: Account for the reserved_space

[Das, Nirmoy]

On 11/18/2022 1:48 PM, Matthew Auld wrote:

From: Chris Wilson 

If the ring is nearly full when calling into emit_pte(), we might
incorrectly trample the reserved_space when constructing the packet to
emit the PTEs. This then triggers the GEM_BUG_ON(rq->reserved_space >
ring->space) when later submitting the request, since the request itself
doesn't have enough space left in the ring to emit things like
workarounds, breadcrumbs etc.

Testcase: igt@i915_selftests@live_emit_pte_full_ring
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7535
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6889
Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration")
Signed-off-by: Chris Wilson 
Signed-off-by: Matthew Auld 
Cc: Andrzej Hajda 
Cc: Nirmoy Das 


Tested this on ATS-M.

Tested-by: Nirmoy Das 

Reviewed-by: Nirmoy Das 


Cc:  # v5.15+
---
  drivers/gpu/drm/i915/gt/intel_migrate.c | 16 
  1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c 
b/drivers/gpu/drm/i915/gt/intel_migrate.c
index b405a04135ca..48c3b5168558 100644
--- a/drivers/gpu/drm/i915/gt/intel_migrate.c
+++ b/drivers/gpu/drm/i915/gt/intel_migrate.c
@@ -342,6 +342,16 @@ static int emit_no_arbitration(struct i915_request *rq)
return 0;
  }
  
+static int max_pte_pkt_size(struct i915_request *rq, int pkt)

+{
+   struct intel_ring *ring = rq->ring;
+
+   pkt = min_t(int, pkt, (ring->space - rq->reserved_space) / sizeof(u32) 
+ 5);
+   pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5);
+
+   return pkt;
+}
+
  static int emit_pte(struct i915_request *rq,
struct sgt_dma *it,
enum i915_cache_level cache_level,
@@ -388,8 +398,7 @@ static int emit_pte(struct i915_request *rq,
return PTR_ERR(cs);
  
  	/* Pack as many PTE updates as possible into a single MI command */

-   pkt = min_t(int, dword_length, ring->space / sizeof(u32) + 5);
-   pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5);
+   pkt = max_pte_pkt_size(rq, dword_length);
  
  	hdr = cs;

*cs++ = MI_STORE_DATA_IMM | REG_BIT(21); /* as qword elements */
@@ -422,8 +431,7 @@ static int emit_pte(struct i915_request *rq,
}
}
  
-			pkt = min_t(int, dword_rem, ring->space / sizeof(u32) + 5);

-   pkt = min_t(int, pkt, (ring->size - ring->emit) / 
sizeof(u32) + 5);
+   pkt = max_pte_pkt_size(rq, dword_rem);
  
  			hdr = cs;

*cs++ = MI_STORE_DATA_IMM | REG_BIT(21);

[Intel-gfx] [PATCH 1/2] drm/i915/migrate: Account for the reserved_space

[Matthew Auld]

From: Chris Wilson 

If the ring is nearly full when calling into emit_pte(), we might
incorrectly trample the reserved_space when constructing the packet to
emit the PTEs. This then triggers the GEM_BUG_ON(rq->reserved_space >
ring->space) when later submitting the request, since the request itself
doesn't have enough space left in the ring to emit things like
workarounds, breadcrumbs etc.

Testcase: igt@i915_selftests@live_emit_pte_full_ring
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7535
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6889
Fixes: cf586021642d ("drm/i915/gt: Pipelined page migration")
Signed-off-by: Chris Wilson 
Signed-off-by: Matthew Auld 
Cc: Andrzej Hajda 
Cc: Nirmoy Das 
Cc:  # v5.15+
---
 drivers/gpu/drm/i915/gt/intel_migrate.c | 16 
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/intel_migrate.c 
b/drivers/gpu/drm/i915/gt/intel_migrate.c
index b405a04135ca..48c3b5168558 100644
--- a/drivers/gpu/drm/i915/gt/intel_migrate.c
+++ b/drivers/gpu/drm/i915/gt/intel_migrate.c
@@ -342,6 +342,16 @@ static int emit_no_arbitration(struct i915_request *rq)
return 0;
 }
 
+static int max_pte_pkt_size(struct i915_request *rq, int pkt)
+{
+   struct intel_ring *ring = rq->ring;
+
+   pkt = min_t(int, pkt, (ring->space - rq->reserved_space) / sizeof(u32) 
+ 5);
+   pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5);
+
+   return pkt;
+}
+
 static int emit_pte(struct i915_request *rq,
struct sgt_dma *it,
enum i915_cache_level cache_level,
@@ -388,8 +398,7 @@ static int emit_pte(struct i915_request *rq,
return PTR_ERR(cs);
 
/* Pack as many PTE updates as possible into a single MI command */
-   pkt = min_t(int, dword_length, ring->space / sizeof(u32) + 5);
-   pkt = min_t(int, pkt, (ring->size - ring->emit) / sizeof(u32) + 5);
+   pkt = max_pte_pkt_size(rq, dword_length);
 
hdr = cs;
*cs++ = MI_STORE_DATA_IMM | REG_BIT(21); /* as qword elements */
@@ -422,8 +431,7 @@ static int emit_pte(struct i915_request *rq,
}
}
 
-   pkt = min_t(int, dword_rem, ring->space / sizeof(u32) + 
5);
-   pkt = min_t(int, pkt, (ring->size - ring->emit) / 
sizeof(u32) + 5);
+   pkt = max_pte_pkt_size(rq, dword_rem);
 
hdr = cs;
*cs++ = MI_STORE_DATA_IMM | REG_BIT(21);
-- 
2.38.1