dma-fence: Document recoverable page fault implications

Commit Message

Daniel Vetter Feb. 3, 2021, 3:29 p.m. UTC

Recently there was a fairly long thread about recoreable hardware page
faults, how they can deadlock, and what to do about that.

While the discussion is still fresh I figured good time to try and
document the conclusions a bit. This documentation section explains
what's the potential problem, and the remedies we've discussed,
roughly ordered from best to worst.

v2: Linus -> Linux typoe (Dave)

v3:
- Make it clear drivers only need to implement one option (Christian)
- Make it clearer that implicit sync is out the window with exclusive
  fences (Christian)
- Add the fairly theoretical option of segementing the memory (either
  statically or through dynamic checks at runtime for which piece of
  memory is managed how) and explain why it's not a great idea (Felix)

References: https://lore.kernel.org/dri-devel/[e-mail]/
Cc: Dave Airlie <[e-mail]>
Cc: Maarten Lankhorst <[e-mail]>
Cc: Thomas Hellström <[e-mail]>
Cc: "Christian König" <[e-mail]>
Cc: Jerome Glisse <[e-mail]>
Cc: Felix Kuehling <[e-mail]>
Signed-off-by: Daniel Vetter <[e-mail]>
Cc: Sumit Semwal <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
---
 Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

Comments

Christian König Feb. 3, 2021, 3:40 p.m. UTC | #1

Am 03.02.21 um 16:29 schrieb Daniel Vetter:
> Recently there was a fairly long thread about recoreable hardware page
> faults, how they can deadlock, and what to do about that.
>
> While the discussion is still fresh I figured good time to try and
> document the conclusions a bit. This documentation section explains
> what's the potential problem, and the remedies we've discussed,
> roughly ordered from best to worst.
>
> v2: Linus -> Linux typoe (Dave)
>
> v3:
> - Make it clear drivers only need to implement one option (Christian)
> - Make it clearer that implicit sync is out the window with exclusive
>    fences (Christian)
> - Add the fairly theoretical option of segementing the memory (either
>    statically or through dynamic checks at runtime for which piece of
>    memory is managed how) and explain why it's not a great idea (Felix)
>
> References: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Fdri-devel%2F20210107030127.20393-1-Felix.Kuehling%40amd.com%2F&data=04%7C01%7Cchristian.koenig%40amd.com%7C767e1096b9554ab5b6dd08d8c8587f0f%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637479629728871138%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Fth2y8c3LuNbweQGrsS7VjYESGlshu6DfQyikiWBwyQ%3D&reserved=0
> Cc: Dave Airlie <[e-mail]>
> Cc: Maarten Lankhorst <[e-mail]>
> Cc: Thomas Hellström <[e-mail]>
> Cc: "Christian König" <[e-mail]>
> Cc: Jerome Glisse <[e-mail]>
> Cc: Felix Kuehling <[e-mail]>
> Signed-off-by: Daniel Vetter <[e-mail]>
> Cc: Sumit Semwal <[e-mail]>
> Cc: [e-mail]
> Cc: [e-mail]

Reviewed-by: Christian König <[e-mail]>

I still haven't fully given up on supporting implicit sync with user 
fences, but it is really an eeek, let's try very hard to avoid that, 
problem.

Christian

> ---
>   Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
>   1 file changed, 76 insertions(+)
>
> diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
> index a2133d69872c..7f37ec30d9fd 100644
> --- a/Documentation/driver-api/dma-buf.rst
> +++ b/Documentation/driver-api/dma-buf.rst
> @@ -257,3 +257,79 @@ fences in the kernel. This means:
>     userspace is allowed to use userspace fencing or long running compute
>     workloads. This also means no implicit fencing for shared buffers in these
>     cases.
> +
> +Recoverable Hardware Page Faults Implications
> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> +
> +Modern hardware supports recoverable page faults, which has a lot of
> +implications for DMA fences.
> +
> +First, a pending page fault obviously holds up the work that's running on the
> +accelerator and a memory allocation is usually required to resolve the fault.
> +But memory allocations are not allowed to gate completion of DMA fences, which
> +means any workload using recoverable page faults cannot use DMA fences for
> +synchronization. Synchronization fences controlled by userspace must be used
> +instead.
> +
> +On GPUs this poses a problem, because current desktop compositor protocols on
> +Linux rely on DMA fences, which means without an entirely new userspace stack
> +built on top of userspace fences, they cannot benefit from recoverable page
> +faults. Specifically this means implicit synchronization will not be possible.
> +The exception is when page faults are only used as migration hints and never to
> +on-demand fill a memory request. For now this means recoverable page
> +faults on GPUs are limited to pure compute workloads.
> +
> +Furthermore GPUs usually have shared resources between the 3D rendering and
> +compute side, like compute units or command submission engines. If both a 3D
> +job with a DMA fence and a compute workload using recoverable page faults are
> +pending they could deadlock:
> +
> +- The 3D workload might need to wait for the compute job to finish and release
> +  hardware resources first.
> +
> +- The compute workload might be stuck in a page fault, because the memory
> +  allocation is waiting for the DMA fence of the 3D workload to complete.
> +
> +There are a few options to prevent this problem, one of which drivers need to
> +ensure:
> +
> +- Compute workloads can always be preempted, even when a page fault is pending
> +  and not yet repaired. Not all hardware supports this.
> +
> +- DMA fence workloads and workloads which need page fault handling have
> +  independent hardware resources to guarantee forward progress. This could be
> +  achieved through e.g. through dedicated engines and minimal compute unit
> +  reservations for DMA fence workloads.
> +
> +- The reservation approach could be further refined by only reserving the
> +  hardware resources for DMA fence workloads when they are in-flight. This must
> +  cover the time from when the DMA fence is visible to other threads up to
> +  moment when fence is completed through dma_fence_signal().
> +
> +- As a last resort, if the hardware provides no useful reservation mechanics,
> +  all workloads must be flushed from the GPU when switching between jobs
> +  requiring DMA fences or jobs requiring page fault handling: This means all DMA
> +  fences must complete before a compute job with page fault handling can be
> +  inserted into the scheduler queue. And vice versa, before a DMA fence can be
> +  made visible anywhere in the system, all compute workloads must be preempted
> +  to guarantee all pending GPU page faults are flushed.
> +
> +- Only a fairly theoretical option would be to untangle these dependencies when
> +  allocating memory to repair hardware page faults, either through separate
> +  memory blocks or runtime tracking of the full dependency graph of all DMA
> +  fences. This results very wide impact on the kernel, since resolving the page
> +  on the CPU side can itself involve a page fault. It is much more feasible and
> +  robust to limit the impact of handling hardware page faults to the specific
> +  driver.
> +
> +Note that workloads that run on independent hardware like copy engines or other
> +GPUs do not have any impact. This allows us to keep using DMA fences internally
> +in the kernel even for resolving hardware page faults, e.g. by using copy
> +engines to clear or copy memory needed to resolve the page fault.
> +
> +In some ways this page fault problem is a special case of the `Infinite DMA
> +Fences` discussions: Infinite fences from compute workloads are allowed to
> +depend on DMA fences, but not the other way around. And not even the page fault
> +problem is new, because some other CPU thread in userspace might
> +hit a page fault which holds up a userspace fence - supporting page faults on
> +GPUs doesn't anything fundamentally new.

Thomas Hellström (Intel) Feb. 24, 2021, 8:47 a.m. UTC | #2

On 2/3/21 4:29 PM, Daniel Vetter wrote:
> Recently there was a fairly long thread about recoreable hardware page
> faults, how they can deadlock, and what to do about that.
>
> While the discussion is still fresh I figured good time to try and
> document the conclusions a bit. This documentation section explains
> what's the potential problem, and the remedies we've discussed,
> roughly ordered from best to worst.
>
> v2: Linus -> Linux typoe (Dave)
>
> v3:
> - Make it clear drivers only need to implement one option (Christian)
> - Make it clearer that implicit sync is out the window with exclusive
>    fences (Christian)
> - Add the fairly theoretical option of segementing the memory (either
>    statically or through dynamic checks at runtime for which piece of
>    memory is managed how) and explain why it's not a great idea (Felix)
>
> References: https://lore.kernel.org/dri-devel/[e-mail]/
> Cc: Dave Airlie <[e-mail]>
> Cc: Maarten Lankhorst <[e-mail]>
> Cc: Thomas Hellström <[e-mail]>
> Cc: "Christian König" <[e-mail]>
> Cc: Jerome Glisse <[e-mail]>
> Cc: Felix Kuehling <[e-mail]>
> Signed-off-by: Daniel Vetter <[e-mail]>
> Cc: Sumit Semwal <[e-mail]>
> Cc: [e-mail]
> Cc: [e-mail]
> ---
>   Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
>   1 file changed, 76 insertions(+)
>
> diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
> index a2133d69872c..7f37ec30d9fd 100644
> --- a/Documentation/driver-api/dma-buf.rst
> +++ b/Documentation/driver-api/dma-buf.rst
> @@ -257,3 +257,79 @@ fences in the kernel. This means:
>     userspace is allowed to use userspace fencing or long running compute
>     workloads. This also means no implicit fencing for shared buffers in these
>     cases.
> +
> +Recoverable Hardware Page Faults Implications
> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> +
> +Modern hardware supports recoverable page faults, which has a lot of
> +implications for DMA fences.
> +
> +First, a pending page fault obviously holds up the work that's running on the
> +accelerator and a memory allocation is usually required to resolve the fault.
> +But memory allocations are not allowed to gate completion of DMA fences, which
> +means any workload using recoverable page faults cannot use DMA fences for
> +synchronization. Synchronization fences controlled by userspace must be used
> +instead.
> +
> +On GPUs this poses a problem, because current desktop compositor protocols on
> +Linux rely on DMA fences, which means without an entirely new userspace stack
> +built on top of userspace fences, they cannot benefit from recoverable page
> +faults. Specifically this means implicit synchronization will not be possible.
> +The exception is when page faults are only used as migration hints and never to
> +on-demand fill a memory request. For now this means recoverable page
> +faults on GPUs are limited to pure compute workloads.
> +
> +Furthermore GPUs usually have shared resources between the 3D rendering and
> +compute side, like compute units or command submission engines. If both a 3D
> +job with a DMA fence and a compute workload using recoverable page faults are
> +pending they could deadlock:
> +
> +- The 3D workload might need to wait for the compute job to finish and release
> +  hardware resources first.
> +
> +- The compute workload might be stuck in a page fault, because the memory
> +  allocation is waiting for the DMA fence of the 3D workload to complete.
> +
> +There are a few options to prevent this problem, one of which drivers need to
> +ensure:
> +
> +- Compute workloads can always be preempted, even when a page fault is pending
> +  and not yet repaired. Not all hardware supports this.
> +
> +- DMA fence workloads and workloads which need page fault handling have
> +  independent hardware resources to guarantee forward progress. This could be
> +  achieved through e.g. through dedicated engines and minimal compute unit
> +  reservations for DMA fence workloads.
> +
> +- The reservation approach could be further refined by only reserving the
> +  hardware resources for DMA fence workloads when they are in-flight. This must
> +  cover the time from when the DMA fence is visible to other threads up to
> +  moment when fence is completed through dma_fence_signal().
> +
> +- As a last resort, if the hardware provides no useful reservation mechanics,
> +  all workloads must be flushed from the GPU when switching between jobs
> +  requiring DMA fences or jobs requiring page fault handling: This means all DMA
> +  fences must complete before a compute job with page fault handling can be
> +  inserted into the scheduler queue. And vice versa, before a DMA fence can be
> +  made visible anywhere in the system, all compute workloads must be preempted
> +  to guarantee all pending GPU page faults are flushed.
> +
> +- Only a fairly theoretical option would be to untangle these dependencies when
> +  allocating memory to repair hardware page faults, either through separate
> +  memory blocks or runtime tracking of the full dependency graph of all DMA
> +  fences. This results very wide impact on the kernel, since resolving the page
> +  on the CPU side can itself involve a page fault. It is much more feasible and
> +  robust to limit the impact of handling hardware page faults to the specific
> +  driver.
> +
> +Note that workloads that run on independent hardware like copy engines or other
> +GPUs do not have any impact. This allows us to keep using DMA fences internally
> +in the kernel even for resolving hardware page faults, e.g. by using copy
> +engines to clear or copy memory needed to resolve the page fault.
> +
> +In some ways this page fault problem is a special case of the `Infinite DMA
> +Fences` discussions: Infinite fences from compute workloads are allowed to
> +depend on DMA fences, but not the other way around. And not even the page fault
> +problem is new, because some other CPU thread in userspace might
> +hit a page fault which holds up a userspace fence - supporting page faults on
> +GPUs doesn't anything fundamentally new.

To me, in general this looks good. One thing, though is that for a first 
time reader it might not be totally clear what's special with a compute 
workload. Perhaps some clarification?

Also since the current cross-driver dma_fence locking order is

1) dma_resv ->
2) memory_allocation / reclaim ->
3) dma_fence_wait/critical

And the locking order required for recoverable pagefault is

a) dma_resv ->
b) fence_wait/critical ->
c) memory_allocation / reclaim

(Possibly with a) and b) interchanged above, Is it possible to service a 
recoverable pagefault without taking the dma_resv lock?)

It's clear that the fence critical section in b) is not compatible with 
the dma_fence wait in 3) and thus the memory restrictions are needed. 
But I think given the memory allocation restrictions for recoverable 
pagefaults I guess at some point we must ask ourselves why are they 
necessary and what's the price to be paid for getting rid of them, and 
document also that. *If* it's the case that it all boils down to the 2) 
-> 3) locking order above, and that's mandated *only* by the dma_fence 
wait in the userptr mmu notifiers, I think these restrictions are a 
pretty high price to pay. Wouldn't it be possible now to replace that 
fence wait with either page pinning (which now is coherent since 5.9) or 
preempt-ctx fences + unpinned pages if available and thus invert the 2) 
-> 3) locking order?

Thanks,
Thomas

Daniel Vetter Feb. 24, 2021, 9:26 a.m. UTC | #3

On Wed, Feb 24, 2021 at 9:47 AM Thomas Hellström (Intel)
<[e-mail]> wrote:
>
>
> On 2/3/21 4:29 PM, Daniel Vetter wrote:
> > Recently there was a fairly long thread about recoreable hardware page
> > faults, how they can deadlock, and what to do about that.
> >
> > While the discussion is still fresh I figured good time to try and
> > document the conclusions a bit. This documentation section explains
> > what's the potential problem, and the remedies we've discussed,
> > roughly ordered from best to worst.
> >
> > v2: Linus -> Linux typoe (Dave)
> >
> > v3:
> > - Make it clear drivers only need to implement one option (Christian)
> > - Make it clearer that implicit sync is out the window with exclusive
> >    fences (Christian)
> > - Add the fairly theoretical option of segementing the memory (either
> >    statically or through dynamic checks at runtime for which piece of
> >    memory is managed how) and explain why it's not a great idea (Felix)
> >
> > References: https://lore.kernel.org/dri-devel/[e-mail]/
> > Cc: Dave Airlie <[e-mail]>
> > Cc: Maarten Lankhorst <[e-mail]>
> > Cc: Thomas Hellström <[e-mail]>
> > Cc: "Christian König" <[e-mail]>
> > Cc: Jerome Glisse <[e-mail]>
> > Cc: Felix Kuehling <[e-mail]>
> > Signed-off-by: Daniel Vetter <[e-mail]>
> > Cc: Sumit Semwal <[e-mail]>
> > Cc: [e-mail]
> > Cc: [e-mail]
> > ---
> >   Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
> >   1 file changed, 76 insertions(+)
> >
> > diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
> > index a2133d69872c..7f37ec30d9fd 100644
> > --- a/Documentation/driver-api/dma-buf.rst
> > +++ b/Documentation/driver-api/dma-buf.rst
> > @@ -257,3 +257,79 @@ fences in the kernel. This means:
> >     userspace is allowed to use userspace fencing or long running compute
> >     workloads. This also means no implicit fencing for shared buffers in these
> >     cases.
> > +
> > +Recoverable Hardware Page Faults Implications
> > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > +
> > +Modern hardware supports recoverable page faults, which has a lot of
> > +implications for DMA fences.
> > +
> > +First, a pending page fault obviously holds up the work that's running on the
> > +accelerator and a memory allocation is usually required to resolve the fault.
> > +But memory allocations are not allowed to gate completion of DMA fences, which
> > +means any workload using recoverable page faults cannot use DMA fences for
> > +synchronization. Synchronization fences controlled by userspace must be used
> > +instead.
> > +
> > +On GPUs this poses a problem, because current desktop compositor protocols on
> > +Linux rely on DMA fences, which means without an entirely new userspace stack
> > +built on top of userspace fences, they cannot benefit from recoverable page
> > +faults. Specifically this means implicit synchronization will not be possible.
> > +The exception is when page faults are only used as migration hints and never to
> > +on-demand fill a memory request. For now this means recoverable page
> > +faults on GPUs are limited to pure compute workloads.
> > +
> > +Furthermore GPUs usually have shared resources between the 3D rendering and
> > +compute side, like compute units or command submission engines. If both a 3D
> > +job with a DMA fence and a compute workload using recoverable page faults are
> > +pending they could deadlock:
> > +
> > +- The 3D workload might need to wait for the compute job to finish and release
> > +  hardware resources first.
> > +
> > +- The compute workload might be stuck in a page fault, because the memory
> > +  allocation is waiting for the DMA fence of the 3D workload to complete.
> > +
> > +There are a few options to prevent this problem, one of which drivers need to
> > +ensure:
> > +
> > +- Compute workloads can always be preempted, even when a page fault is pending
> > +  and not yet repaired. Not all hardware supports this.
> > +
> > +- DMA fence workloads and workloads which need page fault handling have
> > +  independent hardware resources to guarantee forward progress. This could be
> > +  achieved through e.g. through dedicated engines and minimal compute unit
> > +  reservations for DMA fence workloads.
> > +
> > +- The reservation approach could be further refined by only reserving the
> > +  hardware resources for DMA fence workloads when they are in-flight. This must
> > +  cover the time from when the DMA fence is visible to other threads up to
> > +  moment when fence is completed through dma_fence_signal().
> > +
> > +- As a last resort, if the hardware provides no useful reservation mechanics,
> > +  all workloads must be flushed from the GPU when switching between jobs
> > +  requiring DMA fences or jobs requiring page fault handling: This means all DMA
> > +  fences must complete before a compute job with page fault handling can be
> > +  inserted into the scheduler queue. And vice versa, before a DMA fence can be
> > +  made visible anywhere in the system, all compute workloads must be preempted
> > +  to guarantee all pending GPU page faults are flushed.
> > +
> > +- Only a fairly theoretical option would be to untangle these dependencies when
> > +  allocating memory to repair hardware page faults, either through separate
> > +  memory blocks or runtime tracking of the full dependency graph of all DMA
> > +  fences. This results very wide impact on the kernel, since resolving the page
> > +  on the CPU side can itself involve a page fault. It is much more feasible and
> > +  robust to limit the impact of handling hardware page faults to the specific
> > +  driver.
> > +
> > +Note that workloads that run on independent hardware like copy engines or other
> > +GPUs do not have any impact. This allows us to keep using DMA fences internally
> > +in the kernel even for resolving hardware page faults, e.g. by using copy
> > +engines to clear or copy memory needed to resolve the page fault.
> > +
> > +In some ways this page fault problem is a special case of the `Infinite DMA
> > +Fences` discussions: Infinite fences from compute workloads are allowed to
> > +depend on DMA fences, but not the other way around. And not even the page fault
> > +problem is new, because some other CPU thread in userspace might
> > +hit a page fault which holds up a userspace fence - supporting page faults on
> > +GPUs doesn't anything fundamentally new.
>
> To me, in general this looks good. One thing, though is that for a first
> time reader it might not be totally clear what's special with a compute
> workload. Perhaps some clarification?

In the docs this new section is right after the infinite fence
section, which goes through this kind of stuff. So it's not so much
"compute workloads" but "infinite fences", which I think is explained
plenty enough.

> Also since the current cross-driver dma_fence locking order is
>
> 1) dma_resv ->
> 2) memory_allocation / reclaim ->
> 3) dma_fence_wait/critical
>
> And the locking order required for recoverable pagefault is
>
> a) dma_resv ->
> b) fence_wait/critical ->
> c) memory_allocation / reclaim
>
> (Possibly with a) and b) interchanged above, Is it possible to service a
> recoverable pagefault without taking the dma_resv lock?)

It's worse, since the lock order we care about is:
1) mmap_sem
2) dma_resv
3) reclaim
4) dma_fence_wait

And for this nice brave new world of unified shared memory/hmm, we
really need to be able to resolve arbitrary cpu side page faults (with
fixup_user_fault() like the iommu driver does too for PASID mode) to
be able to serve gpu page faults. So even if we take dma_resv
completely out of the system we still have:

1) mmap_sem
2) reclaim
3) dma_fence_wait

So we'd also need to throw out dma_fence_wait, and at that point we're
looking at a new gpu driver stack.

> It's clear that the fence critical section in b) is not compatible with
> the dma_fence wait in 3) and thus the memory restrictions are needed.
> But I think given the memory allocation restrictions for recoverable
> pagefaults I guess at some point we must ask ourselves why are they
> necessary and what's the price to be paid for getting rid of them, and
> document also that. *If* it's the case that it all boils down to the 2)
> -> 3) locking order above, and that's mandated *only* by the dma_fence
> wait in the userptr mmu notifiers, I think these restrictions are a
> pretty high price to pay. Wouldn't it be possible now to replace that
> fence wait with either page pinning (which now is coherent since 5.9) or
> preempt-ctx fences + unpinned pages if available and thus invert the 2)
> -> 3) locking order?

It's not just userptr, it's also shrinkers. mmap_sem requires
GFP_KERNEL allocations, so that already excludes our shrinkers if we
want this. That means gpu memory becomes pinned when it's managed with
dma_fence. Christian König just reworked ttm to stop doing that, to
remove the hard and fairly arbitrary "max 50% of system memory" limit.

The only option that would work is if we throw out dma_fence out and
exclusively manage memory with gpu page faults only. Even across the
gpus that do support page faults that's not true for all workloads,
e.g. nvidia only supports page faults on compute engines, not on any
of the 3d fixed function stuff or media codecs (to my knowledge). So
not going to happen. In addition, this plan requires that we stop
using dma_fence for sync (otherwise you can't use preempt-ctx fences).
That's the "10 year plan to rev the ecosystem" problem, although with
lots of discussions with Christian and Jason from mesa I think we've
boiled this down to a more minimal task list by now:
- vk driver mode that users userspace fences. There's a somewhat nasty
problem here because you can only decide which mode to use when you
know which winsys to use. And with vk that's created after the render
pipeline (unlike gl). Plus it's dynamic, e.g. if you run on X or
wayland without the below stuff support, but then use direct display
and the kernel already has timeline syncobj support, you should
probably use userspace fencing.
- new wayland/x protocol to pass timeline drm_syncob around as syncobj
- drm_syncobj support in atomic ioctl
- compositors switching over to vk + using timeline syncobj for fencing
- new drm_syncobj mode where we wrap a userspace fence: new userspace
would pull the userspace fence out, any legacy drivers would have to
block until the fence has signalled. This sucks compared to current
timeline syncobj, where we just wait for the dma_fence to materialize,
but since it can use the same paths/ioctls it would at least give us a
smooth upgrade path. Inclusive allowing both old and new userspace to
co-exist on the same compositor session.

Note that just preempt-ctx fences alone isn't enough, since you could
end up with something like this:
- compute workload using gpu page faults hangs a all of the
compute/shadercores on page faults, we can't preempt
- concurrently there's a 3d workload running, which because fixed
function, and only preempt between draw calls. it is stuck waiting for
some shader cores to become avaiable. this is possible because most
gpus nowadays have separate command queues for compute/3d workloads
- our kernel page fault handler for the compute job wants to preempt
the 3d workload, which wont happen
- everyone is firmly stuck and the user gets angry

So just requiring that everything uses preempt-ctx fences isn't enough
due to shared resources possible blocking preemption even across
engines. Plus we'd still have the problem that dma_fence_wait from
reclaim isn't allowed, pinning all the 3d workload memory for good.

Aside: This means that for compute workloads using page faults we
cannot use preempt-ctx fences either, but instead memory reclaim has
to exclusively use pte zapping (both shrinker and mmu notifier).

Cheers, Daniel

Thomas Hellström (Intel) Feb. 24, 2021, 11:22 a.m. UTC | #4

On 2/24/21 10:26 AM, Daniel Vetter wrote:
> On Wed, Feb 24, 2021 at 9:47 AM Thomas Hellström (Intel)
> <[e-mail]> wrote:
>>
>> On 2/3/21 4:29 PM, Daniel Vetter wrote:
>>> Recently there was a fairly long thread about recoreable hardware page
>>> faults, how they can deadlock, and what to do about that.
>>>
>>> While the discussion is still fresh I figured good time to try and
>>> document the conclusions a bit. This documentation section explains
>>> what's the potential problem, and the remedies we've discussed,
>>> roughly ordered from best to worst.
>>>
>>> v2: Linus -> Linux typoe (Dave)
>>>
>>> v3:
>>> - Make it clear drivers only need to implement one option (Christian)
>>> - Make it clearer that implicit sync is out the window with exclusive
>>>     fences (Christian)
>>> - Add the fairly theoretical option of segementing the memory (either
>>>     statically or through dynamic checks at runtime for which piece of
>>>     memory is managed how) and explain why it's not a great idea (Felix)
>>>
>>> References: https://lore.kernel.org/dri-devel/[e-mail]/
>>> Cc: Dave Airlie <[e-mail]>
>>> Cc: Maarten Lankhorst <[e-mail]>
>>> Cc: Thomas Hellström <[e-mail]>
>>> Cc: "Christian König" <[e-mail]>
>>> Cc: Jerome Glisse <[e-mail]>
>>> Cc: Felix Kuehling <[e-mail]>
>>> Signed-off-by: Daniel Vetter <[e-mail]>
>>> Cc: Sumit Semwal <[e-mail]>
>>> Cc: [e-mail]
>>> Cc: [e-mail]
>>> ---
>>>    Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
>>>    1 file changed, 76 insertions(+)
>>>
>>> diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
>>> index a2133d69872c..7f37ec30d9fd 100644
>>> --- a/Documentation/driver-api/dma-buf.rst
>>> +++ b/Documentation/driver-api/dma-buf.rst
>>> @@ -257,3 +257,79 @@ fences in the kernel. This means:
>>>      userspace is allowed to use userspace fencing or long running compute
>>>      workloads. This also means no implicit fencing for shared buffers in these
>>>      cases.
>>> +
>>> +Recoverable Hardware Page Faults Implications
>>> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>>> +
>>> +Modern hardware supports recoverable page faults, which has a lot of
>>> +implications for DMA fences.
>>> +
>>> +First, a pending page fault obviously holds up the work that's running on the
>>> +accelerator and a memory allocation is usually required to resolve the fault.
>>> +But memory allocations are not allowed to gate completion of DMA fences, which
>>> +means any workload using recoverable page faults cannot use DMA fences for
>>> +synchronization. Synchronization fences controlled by userspace must be used
>>> +instead.
>>> +
>>> +On GPUs this poses a problem, because current desktop compositor protocols on
>>> +Linux rely on DMA fences, which means without an entirely new userspace stack
>>> +built on top of userspace fences, they cannot benefit from recoverable page
>>> +faults. Specifically this means implicit synchronization will not be possible.
>>> +The exception is when page faults are only used as migration hints and never to
>>> +on-demand fill a memory request. For now this means recoverable page
>>> +faults on GPUs are limited to pure compute workloads.
>>> +
>>> +Furthermore GPUs usually have shared resources between the 3D rendering and
>>> +compute side, like compute units or command submission engines. If both a 3D
>>> +job with a DMA fence and a compute workload using recoverable page faults are
>>> +pending they could deadlock:
>>> +
>>> +- The 3D workload might need to wait for the compute job to finish and release
>>> +  hardware resources first.
>>> +
>>> +- The compute workload might be stuck in a page fault, because the memory
>>> +  allocation is waiting for the DMA fence of the 3D workload to complete.
>>> +
>>> +There are a few options to prevent this problem, one of which drivers need to
>>> +ensure:
>>> +
>>> +- Compute workloads can always be preempted, even when a page fault is pending
>>> +  and not yet repaired. Not all hardware supports this.
>>> +
>>> +- DMA fence workloads and workloads which need page fault handling have
>>> +  independent hardware resources to guarantee forward progress. This could be
>>> +  achieved through e.g. through dedicated engines and minimal compute unit
>>> +  reservations for DMA fence workloads.
>>> +
>>> +- The reservation approach could be further refined by only reserving the
>>> +  hardware resources for DMA fence workloads when they are in-flight. This must
>>> +  cover the time from when the DMA fence is visible to other threads up to
>>> +  moment when fence is completed through dma_fence_signal().
>>> +
>>> +- As a last resort, if the hardware provides no useful reservation mechanics,
>>> +  all workloads must be flushed from the GPU when switching between jobs
>>> +  requiring DMA fences or jobs requiring page fault handling: This means all DMA
>>> +  fences must complete before a compute job with page fault handling can be
>>> +  inserted into the scheduler queue. And vice versa, before a DMA fence can be
>>> +  made visible anywhere in the system, all compute workloads must be preempted
>>> +  to guarantee all pending GPU page faults are flushed.
>>> +
>>> +- Only a fairly theoretical option would be to untangle these dependencies when
>>> +  allocating memory to repair hardware page faults, either through separate
>>> +  memory blocks or runtime tracking of the full dependency graph of all DMA
>>> +  fences. This results very wide impact on the kernel, since resolving the page
>>> +  on the CPU side can itself involve a page fault. It is much more feasible and
>>> +  robust to limit the impact of handling hardware page faults to the specific
>>> +  driver.
>>> +
>>> +Note that workloads that run on independent hardware like copy engines or other
>>> +GPUs do not have any impact. This allows us to keep using DMA fences internally
>>> +in the kernel even for resolving hardware page faults, e.g. by using copy
>>> +engines to clear or copy memory needed to resolve the page fault.
>>> +
>>> +In some ways this page fault problem is a special case of the `Infinite DMA
>>> +Fences` discussions: Infinite fences from compute workloads are allowed to
>>> +depend on DMA fences, but not the other way around. And not even the page fault
>>> +problem is new, because some other CPU thread in userspace might
>>> +hit a page fault which holds up a userspace fence - supporting page faults on
>>> +GPUs doesn't anything fundamentally new.
>> To me, in general this looks good. One thing, though is that for a first
>> time reader it might not be totally clear what's special with a compute
>> workload. Perhaps some clarification?
> In the docs this new section is right after the infinite fence
> section, which goes through this kind of stuff. So it's not so much
> "compute workloads" but "infinite fences", which I think is explained
> plenty enough.
>
OK,
>> Also since the current cross-driver dma_fence locking order is
>>
>> 1) dma_resv ->
>> 2) memory_allocation / reclaim ->
>> 3) dma_fence_wait/critical
>>
>> And the locking order required for recoverable pagefault is
>>
>> a) dma_resv ->
>> b) fence_wait/critical ->
>> c) memory_allocation / reclaim
>>
>> (Possibly with a) and b) interchanged above, Is it possible to service a
>> recoverable pagefault without taking the dma_resv lock?)
> It's worse, since the lock order we care about is:
> 1) mmap_sem
> 2) dma_resv
> 3) reclaim
> 4) dma_fence_wait
>
> And for this nice brave new world of unified shared memory/hmm, we
> really need to be able to resolve arbitrary cpu side page faults (with
> fixup_user_fault() like the iommu driver does too for PASID mode) to
> be able to serve gpu page faults. So even if we take dma_resv
> completely out of the system we still have:
>
> 1) mmap_sem
> 2) reclaim
> 3) dma_fence_wait
>
> So we'd also need to throw out dma_fence_wait, and at that point we're
> looking at a new gpu driver stack.
>
Meaning that the locking order for workloads with recoverable page 
faults becomes:

a) dma_fence_wait/critical
b) mmap_sem
c) dma_resv
d) reclaim

which I agree we can't really use with the current stack whatever we do 
with dma_fence_wait vs reclaim.


>> It's clear that the fence critical section in b) is not compatible with
>> the dma_fence wait in 3) and thus the memory restrictions are needed.
>> But I think given the memory allocation restrictions for recoverable
>> pagefaults I guess at some point we must ask ourselves why are they
>> necessary and what's the price to be paid for getting rid of them, and
>> document also that. *If* it's the case that it all boils down to the 2)
>> -> 3) locking order above, and that's mandated *only* by the dma_fence
>> wait in the userptr mmu notifiers, I think these restrictions are a
>> pretty high price to pay. Wouldn't it be possible now to replace that
>> fence wait with either page pinning (which now is coherent since 5.9) or
>> preempt-ctx fences + unpinned pages if available and thus invert the 2)
>> -> 3) locking order?
> It's not just userptr, it's also shrinkers. mmap_sem requires
> GFP_KERNEL allocations, so that already excludes our shrinkers if we
> want this. That means gpu memory becomes pinned when it's managed with
> dma_fence. Christian König just reworked ttm to stop doing that, to
> remove the hard and fairly arbitrary "max 50% of system memory" limit.

Even with shrinkers, and assuming there is no guarantee we can preempt, 
one could tag memory / bos for release on next reservation / dma_fence 
signal whatever happens first, which would not give memory back on 
direct reclaim, but will eventually release it. Will not help with the 
mmap_sem issue, though.


>
>
> Note that just preempt-ctx fences alone isn't enough, since you could
> end up with something like this:
> - compute workload using gpu page faults hangs a all of the
> compute/shadercores on page faults, we can't preempt
> - concurrently there's a 3d workload running, which because fixed
> function, and only preempt between draw calls. it is stuck waiting for
> some shader cores to become avaiable. this is possible because most
> gpus nowadays have separate command queues for compute/3d workloads
> - our kernel page fault handler for the compute job wants to preempt
> the 3d workload, which wont happen
> - everyone is firmly stuck and the user gets angry
Yes, preempt-ctx fences would indeed have to be guaranteed to be able to 
preempt to work, using one of the options described above, But in 
general, inverting reclaim and dma_fence_wait would actually resolve 
this particular situation, even if it doesn't help with recoverable 
pagefaults due to mmap_sem:

- kernel page fault handler ends up in shrinker tagging 3D workload 
resources for release
- Moves on to another shrinker that succeeds to release enough memory
- Compute workload proceeds
- 3D workload proceeds.

..But just wanting to get the full picture of what the tradeoffs of this 
really are.

/Thomas
>
> So just requiring that everything uses preempt-ctx fences isn't enough
> due to shared resources possible blocking preemption even across
> engines. Plus we'd still have the problem that dma_fence_wait from
> reclaim isn't allowed, pinning all the 3d workload memory for good.
>
> Aside: This means that for compute workloads using page faults we
> cannot use preempt-ctx fences either, but instead memory reclaim has
> to exclusively use pte zapping (both shrinker and mmu notifier).
>
> Cheers, Daniel

Daniel Vetter Feb. 24, 2021, 2:05 p.m. UTC | #5

On Wed, Feb 24, 2021 at 12:22 PM Thomas Hellström (Intel)
<[e-mail]> wrote:
>
>
> On 2/24/21 10:26 AM, Daniel Vetter wrote:
> > On Wed, Feb 24, 2021 at 9:47 AM Thomas Hellström (Intel)
> > <[e-mail]> wrote:
> >>
> >> On 2/3/21 4:29 PM, Daniel Vetter wrote:
> >>> Recently there was a fairly long thread about recoreable hardware page
> >>> faults, how they can deadlock, and what to do about that.
> >>>
> >>> While the discussion is still fresh I figured good time to try and
> >>> document the conclusions a bit. This documentation section explains
> >>> what's the potential problem, and the remedies we've discussed,
> >>> roughly ordered from best to worst.
> >>>
> >>> v2: Linus -> Linux typoe (Dave)
> >>>
> >>> v3:
> >>> - Make it clear drivers only need to implement one option (Christian)
> >>> - Make it clearer that implicit sync is out the window with exclusive
> >>>     fences (Christian)
> >>> - Add the fairly theoretical option of segementing the memory (either
> >>>     statically or through dynamic checks at runtime for which piece of
> >>>     memory is managed how) and explain why it's not a great idea (Felix)
> >>>
> >>> References: https://lore.kernel.org/dri-devel/[e-mail]/
> >>> Cc: Dave Airlie <[e-mail]>
> >>> Cc: Maarten Lankhorst <[e-mail]>
> >>> Cc: Thomas Hellström <[e-mail]>
> >>> Cc: "Christian König" <[e-mail]>
> >>> Cc: Jerome Glisse <[e-mail]>
> >>> Cc: Felix Kuehling <[e-mail]>
> >>> Signed-off-by: Daniel Vetter <[e-mail]>
> >>> Cc: Sumit Semwal <[e-mail]>
> >>> Cc: [e-mail]
> >>> Cc: [e-mail]
> >>> ---
> >>>    Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
> >>>    1 file changed, 76 insertions(+)
> >>>
> >>> diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
> >>> index a2133d69872c..7f37ec30d9fd 100644
> >>> --- a/Documentation/driver-api/dma-buf.rst
> >>> +++ b/Documentation/driver-api/dma-buf.rst
> >>> @@ -257,3 +257,79 @@ fences in the kernel. This means:
> >>>      userspace is allowed to use userspace fencing or long running compute
> >>>      workloads. This also means no implicit fencing for shared buffers in these
> >>>      cases.
> >>> +
> >>> +Recoverable Hardware Page Faults Implications
> >>> +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >>> +
> >>> +Modern hardware supports recoverable page faults, which has a lot of
> >>> +implications for DMA fences.
> >>> +
> >>> +First, a pending page fault obviously holds up the work that's running on the
> >>> +accelerator and a memory allocation is usually required to resolve the fault.
> >>> +But memory allocations are not allowed to gate completion of DMA fences, which
> >>> +means any workload using recoverable page faults cannot use DMA fences for
> >>> +synchronization. Synchronization fences controlled by userspace must be used
> >>> +instead.
> >>> +
> >>> +On GPUs this poses a problem, because current desktop compositor protocols on
> >>> +Linux rely on DMA fences, which means without an entirely new userspace stack
> >>> +built on top of userspace fences, they cannot benefit from recoverable page
> >>> +faults. Specifically this means implicit synchronization will not be possible.
> >>> +The exception is when page faults are only used as migration hints and never to
> >>> +on-demand fill a memory request. For now this means recoverable page
> >>> +faults on GPUs are limited to pure compute workloads.
> >>> +
> >>> +Furthermore GPUs usually have shared resources between the 3D rendering and
> >>> +compute side, like compute units or command submission engines. If both a 3D
> >>> +job with a DMA fence and a compute workload using recoverable page faults are
> >>> +pending they could deadlock:
> >>> +
> >>> +- The 3D workload might need to wait for the compute job to finish and release
> >>> +  hardware resources first.
> >>> +
> >>> +- The compute workload might be stuck in a page fault, because the memory
> >>> +  allocation is waiting for the DMA fence of the 3D workload to complete.
> >>> +
> >>> +There are a few options to prevent this problem, one of which drivers need to
> >>> +ensure:
> >>> +
> >>> +- Compute workloads can always be preempted, even when a page fault is pending
> >>> +  and not yet repaired. Not all hardware supports this.
> >>> +
> >>> +- DMA fence workloads and workloads which need page fault handling have
> >>> +  independent hardware resources to guarantee forward progress. This could be
> >>> +  achieved through e.g. through dedicated engines and minimal compute unit
> >>> +  reservations for DMA fence workloads.
> >>> +
> >>> +- The reservation approach could be further refined by only reserving the
> >>> +  hardware resources for DMA fence workloads when they are in-flight. This must
> >>> +  cover the time from when the DMA fence is visible to other threads up to
> >>> +  moment when fence is completed through dma_fence_signal().
> >>> +
> >>> +- As a last resort, if the hardware provides no useful reservation mechanics,
> >>> +  all workloads must be flushed from the GPU when switching between jobs
> >>> +  requiring DMA fences or jobs requiring page fault handling: This means all DMA
> >>> +  fences must complete before a compute job with page fault handling can be
> >>> +  inserted into the scheduler queue. And vice versa, before a DMA fence can be
> >>> +  made visible anywhere in the system, all compute workloads must be preempted
> >>> +  to guarantee all pending GPU page faults are flushed.
> >>> +
> >>> +- Only a fairly theoretical option would be to untangle these dependencies when
> >>> +  allocating memory to repair hardware page faults, either through separate
> >>> +  memory blocks or runtime tracking of the full dependency graph of all DMA
> >>> +  fences. This results very wide impact on the kernel, since resolving the page
> >>> +  on the CPU side can itself involve a page fault. It is much more feasible and
> >>> +  robust to limit the impact of handling hardware page faults to the specific
> >>> +  driver.
> >>> +
> >>> +Note that workloads that run on independent hardware like copy engines or other
> >>> +GPUs do not have any impact. This allows us to keep using DMA fences internally
> >>> +in the kernel even for resolving hardware page faults, e.g. by using copy
> >>> +engines to clear or copy memory needed to resolve the page fault.
> >>> +
> >>> +In some ways this page fault problem is a special case of the `Infinite DMA
> >>> +Fences` discussions: Infinite fences from compute workloads are allowed to
> >>> +depend on DMA fences, but not the other way around. And not even the page fault
> >>> +problem is new, because some other CPU thread in userspace might
> >>> +hit a page fault which holds up a userspace fence - supporting page faults on
> >>> +GPUs doesn't anything fundamentally new.
> >> To me, in general this looks good. One thing, though is that for a first
> >> time reader it might not be totally clear what's special with a compute
> >> workload. Perhaps some clarification?
> > In the docs this new section is right after the infinite fence
> > section, which goes through this kind of stuff. So it's not so much
> > "compute workloads" but "infinite fences", which I think is explained
> > plenty enough.
> >
> OK,
> >> Also since the current cross-driver dma_fence locking order is
> >>
> >> 1) dma_resv ->
> >> 2) memory_allocation / reclaim ->
> >> 3) dma_fence_wait/critical
> >>
> >> And the locking order required for recoverable pagefault is
> >>
> >> a) dma_resv ->
> >> b) fence_wait/critical ->
> >> c) memory_allocation / reclaim
> >>
> >> (Possibly with a) and b) interchanged above, Is it possible to service a
> >> recoverable pagefault without taking the dma_resv lock?)
> > It's worse, since the lock order we care about is:
> > 1) mmap_sem
> > 2) dma_resv
> > 3) reclaim
> > 4) dma_fence_wait
> >
> > And for this nice brave new world of unified shared memory/hmm, we
> > really need to be able to resolve arbitrary cpu side page faults (with
> > fixup_user_fault() like the iommu driver does too for PASID mode) to
> > be able to serve gpu page faults. So even if we take dma_resv
> > completely out of the system we still have:
> >
> > 1) mmap_sem
> > 2) reclaim
> > 3) dma_fence_wait
> >
> > So we'd also need to throw out dma_fence_wait, and at that point we're
> > looking at a new gpu driver stack.
> >
> Meaning that the locking order for workloads with recoverable page
> faults becomes:
>
> a) dma_fence_wait/critical
> b) mmap_sem
> c) dma_resv
> d) reclaim
>
> which I agree we can't really use with the current stack whatever we do
> with dma_fence_wait vs reclaim.
>
>
> >> It's clear that the fence critical section in b) is not compatible with
> >> the dma_fence wait in 3) and thus the memory restrictions are needed.
> >> But I think given the memory allocation restrictions for recoverable
> >> pagefaults I guess at some point we must ask ourselves why are they
> >> necessary and what's the price to be paid for getting rid of them, and
> >> document also that. *If* it's the case that it all boils down to the 2)
> >> -> 3) locking order above, and that's mandated *only* by the dma_fence
> >> wait in the userptr mmu notifiers, I think these restrictions are a
> >> pretty high price to pay. Wouldn't it be possible now to replace that
> >> fence wait with either page pinning (which now is coherent since 5.9) or
> >> preempt-ctx fences + unpinned pages if available and thus invert the 2)
> >> -> 3) locking order?
> > It's not just userptr, it's also shrinkers. mmap_sem requires
> > GFP_KERNEL allocations, so that already excludes our shrinkers if we
> > want this. That means gpu memory becomes pinned when it's managed with
> > dma_fence. Christian König just reworked ttm to stop doing that, to
> > remove the hard and fairly arbitrary "max 50% of system memory" limit.
>
> Even with shrinkers, and assuming there is no guarantee we can preempt,
> one could tag memory / bos for release on next reservation / dma_fence
> signal whatever happens first, which would not give memory back on
> direct reclaim, but will eventually release it. Will not help with the
> mmap_sem issue, though.
>
>
> >
> >
> > Note that just preempt-ctx fences alone isn't enough, since you could
> > end up with something like this:
> > - compute workload using gpu page faults hangs a all of the
> > compute/shadercores on page faults, we can't preempt
> > - concurrently there's a 3d workload running, which because fixed
> > function, and only preempt between draw calls. it is stuck waiting for
> > some shader cores to become avaiable. this is possible because most
> > gpus nowadays have separate command queues for compute/3d workloads
> > - our kernel page fault handler for the compute job wants to preempt
> > the 3d workload, which wont happen
> > - everyone is firmly stuck and the user gets angry
> Yes, preempt-ctx fences would indeed have to be guaranteed to be able to
> preempt to work, using one of the options described above, But in
> general, inverting reclaim and dma_fence_wait would actually resolve
> this particular situation, even if it doesn't help with recoverable
> pagefaults due to mmap_sem:
>
> - kernel page fault handler ends up in shrinker tagging 3D workload
> resources for release
> - Moves on to another shrinker that succeeds to release enough memory
> - Compute workload proceeds
> - 3D workload proceeds.
>
> ..But just wanting to get the full picture of what the tradeoffs of this
> really are.

The trouble with this is that we still need to guarantee forward
progress. That means we must have enough memory available in other
shrinkers/page-cache which is not hogged by the gpu in any way. E.g.
just removing the dma_fence_wait from the mmu notifier wont help if we
still hold the page refcounts at large.

There's roughly two options:
- Lots of local caches for memory allocations which are sized to
contain the max in-flight working set. This is essentially what the
block layer uses for GFP_NOIO inversions. Problem is you must
guarantee that everyone goes through these mempools, and that they're
actually sized for the worst case. Since we're talking about fixing up
userspace page faults that's pretty much the entire kernel which needs
to be switched over to accurate memory reservation and accounting.

- Other option is what essentially shrinkers/filesystems do with
GFP_NOFS: You hard-limit them to something that's small enough overall
and make sure you still have enough other memory (like normal page
cache, which can be evicted with GFP_NOFS generally) to guarantee
forward progress. Since shrinkers keep looping even when there's
fairly minimal forward progress you should be able to get out of
things again. Problem for us is that we don't just have shrinkers, but
also love to consume arbitrary pagecache with get_user_pages/userptr,
so this is tricky to guarantee. The big hammer approach here what ttm
has done thus far with a hard limit to 50% and a best-effort kthread
that tries to balance things in the background, outside of reclaim.

The other problem I'm seeing is that core kernel is building ever more
features on top of page migration, and there's a fairly constant flow
of work to get to a point where page migration can be guaranteed.
Stuff like get_user_pages vs. pin_user_pages, recent work (I think not
yet merged) to move pages out of ZONE_MOVEABLE if their pinned. This
is because hugepages have become rather critical for performance, and
contiguous memory allocator really has to guarantee it can find its
large blocks (I think there's people looking into using CMA for giant
pages, since you're not going to ever get 1gb pages out of the buddy
allocator). GPUs hogging arbitrary amounts of these pages through
userptr, without being able to release them in a timely manner, does
not look like a design with a bright future.

But yeah if we could just wish away the dma_fence_wait from reclaim
context, all these problems would go away.
-Daniel

> /Thomas
> >
> > So just requiring that everything uses preempt-ctx fences isn't enough
> > due to shared resources possible blocking preemption even across
> > engines. Plus we'd still have the problem that dma_fence_wait from
> > reclaim isn't allowed, pinning all the 3d workload memory for good.
> >
> > Aside: This means that for compute workloads using page faults we
> > cannot use preempt-ctx fences either, but instead memory reclaim has
> > to exclusively use pte zapping (both shrinker and mmu notifier).
> >
> > Cheers, Daniel

Thomas Hellström (Intel) March 3, 2021, 7:07 p.m. UTC | #6

On 2/3/21 4:29 PM, Daniel Vetter wrote:
> Recently there was a fairly long thread about recoreable hardware page
> faults, how they can deadlock, and what to do about that.
>
> While the discussion is still fresh I figured good time to try and
> document the conclusions a bit. This documentation section explains
> what's the potential problem, and the remedies we've discussed,
> roughly ordered from best to worst.
>
> v2: Linus -> Linux typoe (Dave)
>
> v3:
> - Make it clear drivers only need to implement one option (Christian)
> - Make it clearer that implicit sync is out the window with exclusive
>    fences (Christian)
> - Add the fairly theoretical option of segementing the memory (either
>    statically or through dynamic checks at runtime for which piece of
>    memory is managed how) and explain why it's not a great idea (Felix)
>
> References: https://lore.kernel.org/dri-devel/[e-mail]/
> Cc: Dave Airlie <[e-mail]>
> Cc: Maarten Lankhorst <[e-mail]>
> Cc: Thomas Hellström <[e-mail]>
> Cc: "Christian König" <[e-mail]>
> Cc: Jerome Glisse <[e-mail]>
> Cc: Felix Kuehling <[e-mail]>
> Signed-off-by: Daniel Vetter <[e-mail]>
> Cc: Sumit Semwal <[e-mail]>
> Cc: [e-mail]
> Cc: [e-mail]
> ---
>   Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
>   1 file changed, 76 insertions(+)
>
Acked-by: Thomas Hellström <[e-mail]>

Daniel Vetter March 12, 2021, 2:07 p.m. UTC | #7

On Wed, Feb 03, 2021 at 04:40:38PM +0100, Christian König wrote:
> Am 03.02.21 um 16:29 schrieb Daniel Vetter:
> > Recently there was a fairly long thread about recoreable hardware page
> > faults, how they can deadlock, and what to do about that.
> > 
> > While the discussion is still fresh I figured good time to try and
> > document the conclusions a bit. This documentation section explains
> > what's the potential problem, and the remedies we've discussed,
> > roughly ordered from best to worst.
> > 
> > v2: Linus -> Linux typoe (Dave)
> > 
> > v3:
> > - Make it clear drivers only need to implement one option (Christian)
> > - Make it clearer that implicit sync is out the window with exclusive
> >    fences (Christian)
> > - Add the fairly theoretical option of segementing the memory (either
> >    statically or through dynamic checks at runtime for which piece of
> >    memory is managed how) and explain why it's not a great idea (Felix)
> > 
> > References: https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Fdri-devel%2F20210107030127.20393-1-Felix.Kuehling%40amd.com%2F&data=04%7C01%7Cchristian.koenig%40amd.com%7C767e1096b9554ab5b6dd08d8c8587f0f%7C3dd8961fe4884e608e11a82d994e183d%7C0%7C0%7C637479629728871138%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Fth2y8c3LuNbweQGrsS7VjYESGlshu6DfQyikiWBwyQ%3D&reserved=0
> > Cc: Dave Airlie <[e-mail]>
> > Cc: Maarten Lankhorst <[e-mail]>
> > Cc: Thomas Hellström <[e-mail]>
> > Cc: "Christian König" <[e-mail]>
> > Cc: Jerome Glisse <[e-mail]>
> > Cc: Felix Kuehling <[e-mail]>
> > Signed-off-by: Daniel Vetter <[e-mail]>
> > Cc: Sumit Semwal <[e-mail]>
> > Cc: [e-mail]
> > Cc: [e-mail]
> 
> Reviewed-by: Christian König <[e-mail]>

Pulled this in, thanks everyone who helped clarify the situation here.

Cheers, Daniel

> I still haven't fully given up on supporting implicit sync with user fences,
> but it is really an eeek, let's try very hard to avoid that, problem.
> 
> Christian
> 
> > ---
> >   Documentation/driver-api/dma-buf.rst | 76 ++++++++++++++++++++++++++++
> >   1 file changed, 76 insertions(+)
> > 
> > diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
> > index a2133d69872c..7f37ec30d9fd 100644
> > --- a/Documentation/driver-api/dma-buf.rst
> > +++ b/Documentation/driver-api/dma-buf.rst
> > @@ -257,3 +257,79 @@ fences in the kernel. This means:
> >     userspace is allowed to use userspace fencing or long running compute
> >     workloads. This also means no implicit fencing for shared buffers in these
> >     cases.
> > +
> > +Recoverable Hardware Page Faults Implications
> > +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > +
> > +Modern hardware supports recoverable page faults, which has a lot of
> > +implications for DMA fences.
> > +
> > +First, a pending page fault obviously holds up the work that's running on the
> > +accelerator and a memory allocation is usually required to resolve the fault.
> > +But memory allocations are not allowed to gate completion of DMA fences, which
> > +means any workload using recoverable page faults cannot use DMA fences for
> > +synchronization. Synchronization fences controlled by userspace must be used
> > +instead.
> > +
> > +On GPUs this poses a problem, because current desktop compositor protocols on
> > +Linux rely on DMA fences, which means without an entirely new userspace stack
> > +built on top of userspace fences, they cannot benefit from recoverable page
> > +faults. Specifically this means implicit synchronization will not be possible.
> > +The exception is when page faults are only used as migration hints and never to
> > +on-demand fill a memory request. For now this means recoverable page
> > +faults on GPUs are limited to pure compute workloads.
> > +
> > +Furthermore GPUs usually have shared resources between the 3D rendering and
> > +compute side, like compute units or command submission engines. If both a 3D
> > +job with a DMA fence and a compute workload using recoverable page faults are
> > +pending they could deadlock:
> > +
> > +- The 3D workload might need to wait for the compute job to finish and release
> > +  hardware resources first.
> > +
> > +- The compute workload might be stuck in a page fault, because the memory
> > +  allocation is waiting for the DMA fence of the 3D workload to complete.
> > +
> > +There are a few options to prevent this problem, one of which drivers need to
> > +ensure:
> > +
> > +- Compute workloads can always be preempted, even when a page fault is pending
> > +  and not yet repaired. Not all hardware supports this.
> > +
> > +- DMA fence workloads and workloads which need page fault handling have
> > +  independent hardware resources to guarantee forward progress. This could be
> > +  achieved through e.g. through dedicated engines and minimal compute unit
> > +  reservations for DMA fence workloads.
> > +
> > +- The reservation approach could be further refined by only reserving the
> > +  hardware resources for DMA fence workloads when they are in-flight. This must
> > +  cover the time from when the DMA fence is visible to other threads up to
> > +  moment when fence is completed through dma_fence_signal().
> > +
> > +- As a last resort, if the hardware provides no useful reservation mechanics,
> > +  all workloads must be flushed from the GPU when switching between jobs
> > +  requiring DMA fences or jobs requiring page fault handling: This means all DMA
> > +  fences must complete before a compute job with page fault handling can be
> > +  inserted into the scheduler queue. And vice versa, before a DMA fence can be
> > +  made visible anywhere in the system, all compute workloads must be preempted
> > +  to guarantee all pending GPU page faults are flushed.
> > +
> > +- Only a fairly theoretical option would be to untangle these dependencies when
> > +  allocating memory to repair hardware page faults, either through separate
> > +  memory blocks or runtime tracking of the full dependency graph of all DMA
> > +  fences. This results very wide impact on the kernel, since resolving the page
> > +  on the CPU side can itself involve a page fault. It is much more feasible and
> > +  robust to limit the impact of handling hardware page faults to the specific
> > +  driver.
> > +
> > +Note that workloads that run on independent hardware like copy engines or other
> > +GPUs do not have any impact. This allows us to keep using DMA fences internally
> > +in the kernel even for resolving hardware page faults, e.g. by using copy
> > +engines to clear or copy memory needed to resolve the page fault.
> > +
> > +In some ways this page fault problem is a special case of the `Infinite DMA
> > +Fences` discussions: Infinite fences from compute workloads are allowed to
> > +depend on DMA fences, but not the other way around. And not even the page fault
> > +problem is new, because some other CPU thread in userspace might
> > +hit a page fault which holds up a userspace fence - supporting page faults on
> > +GPUs doesn't anything fundamentally new.
>

Patch

diff --git a/Documentation/driver-api/dma-buf.rst b/Documentation/driver-api/dma-buf.rst
index a2133d69872c..7f37ec30d9fd 100644
--- a/Documentation/driver-api/dma-buf.rst
+++ b/Documentation/driver-api/dma-buf.rst
@@ -257,3 +257,79 @@  fences in the kernel. This means:
   userspace is allowed to use userspace fencing or long running compute
   workloads. This also means no implicit fencing for shared buffers in these
   cases.
+
+Recoverable Hardware Page Faults Implications
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Modern hardware supports recoverable page faults, which has a lot of
+implications for DMA fences.
+
+First, a pending page fault obviously holds up the work that's running on the
+accelerator and a memory allocation is usually required to resolve the fault.
+But memory allocations are not allowed to gate completion of DMA fences, which
+means any workload using recoverable page faults cannot use DMA fences for
+synchronization. Synchronization fences controlled by userspace must be used
+instead.
+
+On GPUs this poses a problem, because current desktop compositor protocols on
+Linux rely on DMA fences, which means without an entirely new userspace stack
+built on top of userspace fences, they cannot benefit from recoverable page
+faults. Specifically this means implicit synchronization will not be possible.
+The exception is when page faults are only used as migration hints and never to
+on-demand fill a memory request. For now this means recoverable page
+faults on GPUs are limited to pure compute workloads.
+
+Furthermore GPUs usually have shared resources between the 3D rendering and
+compute side, like compute units or command submission engines. If both a 3D
+job with a DMA fence and a compute workload using recoverable page faults are
+pending they could deadlock:
+
+- The 3D workload might need to wait for the compute job to finish and release
+  hardware resources first.
+
+- The compute workload might be stuck in a page fault, because the memory
+  allocation is waiting for the DMA fence of the 3D workload to complete.
+
+There are a few options to prevent this problem, one of which drivers need to
+ensure:
+
+- Compute workloads can always be preempted, even when a page fault is pending
+  and not yet repaired. Not all hardware supports this.
+
+- DMA fence workloads and workloads which need page fault handling have
+  independent hardware resources to guarantee forward progress. This could be
+  achieved through e.g. through dedicated engines and minimal compute unit
+  reservations for DMA fence workloads.
+
+- The reservation approach could be further refined by only reserving the
+  hardware resources for DMA fence workloads when they are in-flight. This must
+  cover the time from when the DMA fence is visible to other threads up to
+  moment when fence is completed through dma_fence_signal().
+
+- As a last resort, if the hardware provides no useful reservation mechanics,
+  all workloads must be flushed from the GPU when switching between jobs
+  requiring DMA fences or jobs requiring page fault handling: This means all DMA
+  fences must complete before a compute job with page fault handling can be
+  inserted into the scheduler queue. And vice versa, before a DMA fence can be
+  made visible anywhere in the system, all compute workloads must be preempted
+  to guarantee all pending GPU page faults are flushed.
+
+- Only a fairly theoretical option would be to untangle these dependencies when
+  allocating memory to repair hardware page faults, either through separate
+  memory blocks or runtime tracking of the full dependency graph of all DMA
+  fences. This results very wide impact on the kernel, since resolving the page
+  on the CPU side can itself involve a page fault. It is much more feasible and
+  robust to limit the impact of handling hardware page faults to the specific
+  driver.
+
+Note that workloads that run on independent hardware like copy engines or other
+GPUs do not have any impact. This allows us to keep using DMA fences internally
+in the kernel even for resolving hardware page faults, e.g. by using copy
+engines to clear or copy memory needed to resolve the page fault.
+
+In some ways this page fault problem is a special case of the `Infinite DMA
+Fences` discussions: Infinite fences from compute workloads are allowed to
+depend on DMA fences, but not the other way around. And not even the page fault
+problem is new, because some other CPU thread in userspace might
+hit a page fault which holds up a userspace fence - supporting page faults on
+GPUs doesn't anything fundamentally new.