[PATCH v2 0/5] drm/msm: add a display mmu fault handler

[PATCH v2 0/5] drm/msm: add a display mmu fault handler

[Jessica Zhang]

To debug display mmu faults, this series introduces a display fault
handler similar to the gpu one.

This series has been tested on sc7280 chromebook by using triggering
a smmu fault by forcing an incorrect stride on the planes.

---
Changes in v2:
- Reset fault_snapshot_capture flag in atomic commit tail (Rob)

changes since RFC:
	- move msm_mmu_set_fault_handler() to msm_kms_init_aspace
	- make msm_kms_fault_handler return -ENOSYS
	- use msm_disp_snapshot_state() instead of msm_disp_snapshot_state_sync()
	  because smmu fault handler should not sleep
	- add a rate limiter for the snapshot to avoid spam

---
Abhinav Kumar (5):
      drm/msm: register a fault handler for display mmu faults
      drm/msm/iommu: rename msm_fault_handler to msm_gpu_fault_handler
      drm/msm/iommu: introduce msm_iommu_disp_new() for msm_kms
      drm/msm: switch msm_kms to use msm_iommu_disp_new()
      drm/msm/dpu: rate limit snapshot capture for mmu faults

 drivers/gpu/drm/msm/msm_atomic.c |  2 ++
 drivers/gpu/drm/msm/msm_iommu.c  | 32 +++++++++++++++++++++++++++++---
 drivers/gpu/drm/msm/msm_kms.c    | 18 +++++++++++++++++-
 drivers/gpu/drm/msm/msm_kms.h    |  3 +++
 drivers/gpu/drm/msm/msm_mmu.h    |  1 +
 5 files changed, 52 insertions(+), 4 deletions(-)
---
base-commit: 86313a9cd152330c634b25d826a281c6a002eb77
change-id: 20241217-abhinavk-smmu-fault-handler-ade75fef9809

Best regards,
-- 
Jessica Zhang <quic_jesszhan@quicinc.com>

[PATCH v2 1/5] drm/msm: register a fault handler for display mmu faults

[Jessica Zhang]

From: Abhinav Kumar <quic_abhinavk@quicinc.com>

In preparation to register a iommu fault handler for display
related modules, register a fault handler for the backing
mmu object of msm_kms.

Currently, the fault handler only captures the display snapshot
but we can expand this later if more information needs to be
added to debug display mmu faults.

Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
---
 drivers/gpu/drm/msm/msm_kms.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
index f3326d09bdbce19d40d0b48549c330c2b836476f..cf5f15b9cd16a23e9bea820cfc096caa0d7da175 100644
--- a/drivers/gpu/drm/msm/msm_kms.c
+++ b/drivers/gpu/drm/msm/msm_kms.c
@@ -164,12 +164,23 @@ void msm_crtc_disable_vblank(struct drm_crtc *crtc)
 	vblank_ctrl_queue_work(priv, crtc, false);
 }
 
+static int msm_kms_fault_handler(void *arg, unsigned long iova, int flags, void *data)
+{
+	struct msm_kms *kms = arg;
+
+	msm_disp_snapshot_state(kms->dev);
+
+	return -ENOSYS;
+}
+
 struct msm_gem_address_space *msm_kms_init_aspace(struct drm_device *dev)
 {
 	struct msm_gem_address_space *aspace;
 	struct msm_mmu *mmu;
 	struct device *mdp_dev = dev->dev;
 	struct device *mdss_dev = mdp_dev->parent;
+	struct msm_drm_private *priv = dev->dev_private;
+	struct msm_kms *kms = priv->kms;
 	struct device *iommu_dev;
 
 	/*
@@ -197,6 +208,8 @@ struct msm_gem_address_space *msm_kms_init_aspace(struct drm_device *dev)
 		mmu->funcs->destroy(mmu);
 	}
 
+	msm_mmu_set_fault_handler(aspace->mmu, kms, msm_kms_fault_handler);
+
 	return aspace;
 }
 

-- 
2.34.1

[PATCH v2 2/5] drm/msm/iommu: rename msm_fault_handler to msm_gpu_fault_handler

[Jessica Zhang]

From: Abhinav Kumar <quic_abhinavk@quicinc.com>

In preparation of registering a separate fault handler for
display, lets rename the existing msm_fault_handler to
msm_gpu_fault_handler.

Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
---
 drivers/gpu/drm/msm/msm_iommu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index 2a94e82316f95c5f9dcc37ef0a4664a29e3492b2..20518bf9898af1b5798f7c96ddfd0f1bef90df76 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -243,7 +243,7 @@ static const struct iommu_flush_ops tlb_ops = {
 	.tlb_add_page = msm_iommu_tlb_add_page,
 };
 
-static int msm_fault_handler(struct iommu_domain *domain, struct device *dev,
+static int msm_gpu_fault_handler(struct iommu_domain *domain, struct device *dev,
 		unsigned long iova, int flags, void *arg);
 
 struct msm_mmu *msm_iommu_pagetable_create(struct msm_mmu *parent)
@@ -319,7 +319,7 @@ struct msm_mmu *msm_iommu_pagetable_create(struct msm_mmu *parent)
 	return &pagetable->base;
 }
 
-static int msm_fault_handler(struct iommu_domain *domain, struct device *dev,
+static int msm_gpu_fault_handler(struct iommu_domain *domain, struct device *dev,
 		unsigned long iova, int flags, void *arg)
 {
 	struct msm_iommu *iommu = arg;
@@ -448,7 +448,7 @@ struct msm_mmu *msm_iommu_gpu_new(struct device *dev, struct msm_gpu *gpu, unsig
 		return mmu;
 
 	iommu = to_msm_iommu(mmu);
-	iommu_set_fault_handler(iommu->domain, msm_fault_handler, iommu);
+	iommu_set_fault_handler(iommu->domain, msm_gpu_fault_handler, iommu);
 
 	/* Enable stall on iommu fault: */
 	if (adreno_smmu->set_stall)

-- 
2.34.1

[PATCH v2 3/5] drm/msm/iommu: introduce msm_iommu_disp_new() for msm_kms

[Jessica Zhang]

From: Abhinav Kumar <quic_abhinavk@quicinc.com>

Introduce a new API msm_iommu_disp_new() for display use-cases.

Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
---
 drivers/gpu/drm/msm/msm_iommu.c | 26 ++++++++++++++++++++++++++
 drivers/gpu/drm/msm/msm_mmu.h   |  1 +
 2 files changed, 27 insertions(+)

diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index 20518bf9898af1b5798f7c96ddfd0f1bef90df76..b5d8503d28f9b4b82265af2b3df48994b94ff0fc 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -343,6 +343,17 @@ static int msm_gpu_fault_handler(struct iommu_domain *domain, struct device *dev
 	return 0;
 }
 
+static int msm_disp_fault_handler(struct iommu_domain *domain, struct device *dev,
+				  unsigned long iova, int flags, void *arg)
+{
+	struct msm_iommu *iommu = arg;
+
+	if (iommu->base.handler)
+		return iommu->base.handler(iommu->base.arg, iova, flags, NULL);
+
+	return -ENOSYS;
+}
+
 static void msm_iommu_resume_translation(struct msm_mmu *mmu)
 {
 	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(mmu->dev);
@@ -437,6 +448,21 @@ struct msm_mmu *msm_iommu_new(struct device *dev, unsigned long quirks)
 	return &iommu->base;
 }
 
+struct msm_mmu *msm_iommu_disp_new(struct device *dev, unsigned long quirks)
+{
+	struct msm_iommu *iommu;
+	struct msm_mmu *mmu;
+
+	mmu = msm_iommu_new(dev, quirks);
+	if (IS_ERR_OR_NULL(mmu))
+		return mmu;
+
+	iommu = to_msm_iommu(mmu);
+	iommu_set_fault_handler(iommu->domain, msm_disp_fault_handler, iommu);
+
+	return mmu;
+}
+
 struct msm_mmu *msm_iommu_gpu_new(struct device *dev, struct msm_gpu *gpu, unsigned long quirks)
 {
 	struct adreno_smmu_priv *adreno_smmu = dev_get_drvdata(dev);
diff --git a/drivers/gpu/drm/msm/msm_mmu.h b/drivers/gpu/drm/msm/msm_mmu.h
index 88af4f490881f2a6789ae2d03e1c02d10046331a..730458d08d6b0ddf16358eb12d7a991fe39fe77e 100644
--- a/drivers/gpu/drm/msm/msm_mmu.h
+++ b/drivers/gpu/drm/msm/msm_mmu.h
@@ -42,6 +42,7 @@ static inline void msm_mmu_init(struct msm_mmu *mmu, struct device *dev,
 
 struct msm_mmu *msm_iommu_new(struct device *dev, unsigned long quirks);
 struct msm_mmu *msm_iommu_gpu_new(struct device *dev, struct msm_gpu *gpu, unsigned long quirks);
+struct msm_mmu *msm_iommu_disp_new(struct device *dev, unsigned long quirks);
 
 static inline void msm_mmu_set_fault_handler(struct msm_mmu *mmu, void *arg,
 		int (*handler)(void *arg, unsigned long iova, int flags, void *data))

-- 
2.34.1

[PATCH v2 4/5] drm/msm: switch msm_kms to use msm_iommu_disp_new()

[Jessica Zhang]

From: Abhinav Kumar <quic_abhinavk@quicinc.com>

Switch msm_kms to use msm_iommu_disp_new() so that the newly
registered fault handler will kick-in during any mmu faults.

Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
---
 drivers/gpu/drm/msm/msm_kms.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
index cf5f15b9cd16a23e9bea820cfc096caa0d7da175..78830e446355f77154fa21a5d107635bc88ba3ed 100644
--- a/drivers/gpu/drm/msm/msm_kms.c
+++ b/drivers/gpu/drm/msm/msm_kms.c
@@ -192,7 +192,7 @@ struct msm_gem_address_space *msm_kms_init_aspace(struct drm_device *dev)
 	else
 		iommu_dev = mdss_dev;
 
-	mmu = msm_iommu_new(iommu_dev, 0);
+	mmu = msm_iommu_disp_new(iommu_dev, 0);
 	if (IS_ERR(mmu))
 		return ERR_CAST(mmu);
 

-- 
2.34.1

[PATCH v2 5/5] drm/msm/dpu: rate limit snapshot capture for mmu faults

[Jessica Zhang]

From: Abhinav Kumar <quic_abhinavk@quicinc.com>

There is no recovery mechanism in place yet to recover from mmu
faults for DPU. We can only prevent the faults by making sure there
is no misconfiguration.

Rate-limit the snapshot capture for mmu faults to once per
msm_atomic_commit_tail() as that should be sufficient to capture
the snapshot for debugging otherwise there will be a lot of DPU
snapshots getting captured for the same fault which is redundant
and also might affect capturing even one snapshot accurately.

Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
---
 drivers/gpu/drm/msm/msm_atomic.c | 2 ++
 drivers/gpu/drm/msm/msm_kms.c    | 5 ++++-
 drivers/gpu/drm/msm/msm_kms.h    | 3 +++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
index 9c45d641b5212c11078ab38c13a519663d85e10a..9ad7eeb14d4336abd9d8a8eb1382bdddce80508a 100644
--- a/drivers/gpu/drm/msm/msm_atomic.c
+++ b/drivers/gpu/drm/msm/msm_atomic.c
@@ -228,6 +228,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
 	if (kms->funcs->prepare_commit)
 		kms->funcs->prepare_commit(kms, state);
 
+	kms->fault_snapshot_capture = 0;
+
 	/*
 	 * Push atomic updates down to hardware:
 	 */
diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
index 78830e446355f77154fa21a5d107635bc88ba3ed..3327caf396d4fc905dc127f09515559c12666dc8 100644
--- a/drivers/gpu/drm/msm/msm_kms.c
+++ b/drivers/gpu/drm/msm/msm_kms.c
@@ -168,7 +168,10 @@ static int msm_kms_fault_handler(void *arg, unsigned long iova, int flags, void
 {
 	struct msm_kms *kms = arg;
 
-	msm_disp_snapshot_state(kms->dev);
+	if (!kms->fault_snapshot_capture) {
+		msm_disp_snapshot_state(kms->dev);
+		kms->fault_snapshot_capture++;
+	}
 
 	return -ENOSYS;
 }
diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
index e60162744c669773b6e5aef824a173647626ab4e..3ac089e26e14b824567f3cd2c62f82a1b9ea9878 100644
--- a/drivers/gpu/drm/msm/msm_kms.h
+++ b/drivers/gpu/drm/msm/msm_kms.h
@@ -128,6 +128,9 @@ struct msm_kms {
 	int irq;
 	bool irq_requested;
 
+	/* rate limit the snapshot capture to once per attach */
+	int fault_snapshot_capture;
+
 	/* mapper-id used to request GEM buffer mapped for scanout: */
 	struct msm_gem_address_space *aspace;
 

-- 
2.34.1

Re: [PATCH v2 5/5] drm/msm/dpu: rate limit snapshot capture for mmu faults

[Dmitry Baryshkov]

On Tue, Dec 17, 2024 at 04:27:57PM -0800, Jessica Zhang wrote:
> From: Abhinav Kumar <quic_abhinavk@quicinc.com>
> 
> There is no recovery mechanism in place yet to recover from mmu
> faults for DPU. We can only prevent the faults by making sure there
> is no misconfiguration.
> 
> Rate-limit the snapshot capture for mmu faults to once per
> msm_atomic_commit_tail() as that should be sufficient to capture
> the snapshot for debugging otherwise there will be a lot of DPU
> snapshots getting captured for the same fault which is redundant
> and also might affect capturing even one snapshot accurately.
> 
> Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
> Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
> ---
>  drivers/gpu/drm/msm/msm_atomic.c | 2 ++
>  drivers/gpu/drm/msm/msm_kms.c    | 5 ++++-
>  drivers/gpu/drm/msm/msm_kms.h    | 3 +++
>  3 files changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
> index 9c45d641b5212c11078ab38c13a519663d85e10a..9ad7eeb14d4336abd9d8a8eb1382bdddce80508a 100644
> --- a/drivers/gpu/drm/msm/msm_atomic.c
> +++ b/drivers/gpu/drm/msm/msm_atomic.c
> @@ -228,6 +228,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
>  	if (kms->funcs->prepare_commit)
>  		kms->funcs->prepare_commit(kms, state);
>  
> +	kms->fault_snapshot_capture = 0;
> +

- Please move it before the prepare_commit().
- You are accessing the same variable from different threads / cores.
  There should be some kind of a sync barrier.

>  	/*
>  	 * Push atomic updates down to hardware:
>  	 */
> diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
> index 78830e446355f77154fa21a5d107635bc88ba3ed..3327caf396d4fc905dc127f09515559c12666dc8 100644
> --- a/drivers/gpu/drm/msm/msm_kms.c
> +++ b/drivers/gpu/drm/msm/msm_kms.c
> @@ -168,7 +168,10 @@ static int msm_kms_fault_handler(void *arg, unsigned long iova, int flags, void
>  {
>  	struct msm_kms *kms = arg;
>  
> -	msm_disp_snapshot_state(kms->dev);
> +	if (!kms->fault_snapshot_capture) {
> +		msm_disp_snapshot_state(kms->dev);
> +		kms->fault_snapshot_capture++;
> +	}
>  
>  	return -ENOSYS;
>  }
> diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
> index e60162744c669773b6e5aef824a173647626ab4e..3ac089e26e14b824567f3cd2c62f82a1b9ea9878 100644
> --- a/drivers/gpu/drm/msm/msm_kms.h
> +++ b/drivers/gpu/drm/msm/msm_kms.h
> @@ -128,6 +128,9 @@ struct msm_kms {
>  	int irq;
>  	bool irq_requested;
>  
> +	/* rate limit the snapshot capture to once per attach */
> +	int fault_snapshot_capture;
> +
>  	/* mapper-id used to request GEM buffer mapped for scanout: */
>  	struct msm_gem_address_space *aspace;
>  
> 
> -- 
> 2.34.1
> 

-- 
With best wishes
Dmitry

Re: [PATCH v2 5/5] drm/msm/dpu: rate limit snapshot capture for mmu faults

[Jessica Zhang]

On 12/18/2024 3:20 AM, Dmitry Baryshkov wrote:
> On Tue, Dec 17, 2024 at 04:27:57PM -0800, Jessica Zhang wrote:
>> From: Abhinav Kumar <quic_abhinavk@quicinc.com>
>>
>> There is no recovery mechanism in place yet to recover from mmu
>> faults for DPU. We can only prevent the faults by making sure there
>> is no misconfiguration.
>>
>> Rate-limit the snapshot capture for mmu faults to once per
>> msm_atomic_commit_tail() as that should be sufficient to capture
>> the snapshot for debugging otherwise there will be a lot of DPU
>> snapshots getting captured for the same fault which is redundant
>> and also might affect capturing even one snapshot accurately.
>>
>> Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
>> Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
>> ---
>>   drivers/gpu/drm/msm/msm_atomic.c | 2 ++
>>   drivers/gpu/drm/msm/msm_kms.c    | 5 ++++-
>>   drivers/gpu/drm/msm/msm_kms.h    | 3 +++
>>   3 files changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/msm/msm_atomic.c b/drivers/gpu/drm/msm/msm_atomic.c
>> index 9c45d641b5212c11078ab38c13a519663d85e10a..9ad7eeb14d4336abd9d8a8eb1382bdddce80508a 100644
>> --- a/drivers/gpu/drm/msm/msm_atomic.c
>> +++ b/drivers/gpu/drm/msm/msm_atomic.c
>> @@ -228,6 +228,8 @@ void msm_atomic_commit_tail(struct drm_atomic_state *state)
>>   	if (kms->funcs->prepare_commit)
>>   		kms->funcs->prepare_commit(kms, state);
>>   
>> +	kms->fault_snapshot_capture = 0;
>> +
> 
> - Please move it before the prepare_commit().
> - You are accessing the same variable from different threads / cores.
>    There should be some kind of a sync barrier.

Hi Dmitry,

Ack, will add a lock for the snapshot capture counter.

Thanks,

Jessica Zhang

> 
>>   	/*
>>   	 * Push atomic updates down to hardware:
>>   	 */
>> diff --git a/drivers/gpu/drm/msm/msm_kms.c b/drivers/gpu/drm/msm/msm_kms.c
>> index 78830e446355f77154fa21a5d107635bc88ba3ed..3327caf396d4fc905dc127f09515559c12666dc8 100644
>> --- a/drivers/gpu/drm/msm/msm_kms.c
>> +++ b/drivers/gpu/drm/msm/msm_kms.c
>> @@ -168,7 +168,10 @@ static int msm_kms_fault_handler(void *arg, unsigned long iova, int flags, void
>>   {
>>   	struct msm_kms *kms = arg;
>>   
>> -	msm_disp_snapshot_state(kms->dev);
>> +	if (!kms->fault_snapshot_capture) {
>> +		msm_disp_snapshot_state(kms->dev);
>> +		kms->fault_snapshot_capture++;
>> +	}
>>   
>>   	return -ENOSYS;
>>   }
>> diff --git a/drivers/gpu/drm/msm/msm_kms.h b/drivers/gpu/drm/msm/msm_kms.h
>> index e60162744c669773b6e5aef824a173647626ab4e..3ac089e26e14b824567f3cd2c62f82a1b9ea9878 100644
>> --- a/drivers/gpu/drm/msm/msm_kms.h
>> +++ b/drivers/gpu/drm/msm/msm_kms.h
>> @@ -128,6 +128,9 @@ struct msm_kms {
>>   	int irq;
>>   	bool irq_requested;
>>   
>> +	/* rate limit the snapshot capture to once per attach */
>> +	int fault_snapshot_capture;
>> +
>>   	/* mapper-id used to request GEM buffer mapped for scanout: */
>>   	struct msm_gem_address_space *aspace;
>>   
>>
>> -- 
>> 2.34.1
>>
> 
> -- 
> With best wishes
> Dmitry

Re: [PATCH v2 5/5] drm/msm/dpu: rate limit snapshot capture for mmu faults

[Abhinav Kumar]

On 12/18/2024 1:33 PM, Jessica Zhang wrote:
> 
> 
> On 12/18/2024 3:20 AM, Dmitry Baryshkov wrote:
>> On Tue, Dec 17, 2024 at 04:27:57PM -0800, Jessica Zhang wrote:
>>> From: Abhinav Kumar <quic_abhinavk@quicinc.com>
>>>
>>> There is no recovery mechanism in place yet to recover from mmu
>>> faults for DPU. We can only prevent the faults by making sure there
>>> is no misconfiguration.
>>>
>>> Rate-limit the snapshot capture for mmu faults to once per
>>> msm_atomic_commit_tail() as that should be sufficient to capture
>>> the snapshot for debugging otherwise there will be a lot of DPU
>>> snapshots getting captured for the same fault which is redundant
>>> and also might affect capturing even one snapshot accurately.
>>>
>>> Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
>>> Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
>>> ---
>>>   drivers/gpu/drm/msm/msm_atomic.c | 2 ++
>>>   drivers/gpu/drm/msm/msm_kms.c    | 5 ++++-
>>>   drivers/gpu/drm/msm/msm_kms.h    | 3 +++
>>>   3 files changed, 9 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/gpu/drm/msm/msm_atomic.c 
>>> b/drivers/gpu/drm/msm/msm_atomic.c
>>> index 
>>> 9c45d641b5212c11078ab38c13a519663d85e10a..9ad7eeb14d4336abd9d8a8eb1382bdddce80508a 100644
>>> --- a/drivers/gpu/drm/msm/msm_atomic.c
>>> +++ b/drivers/gpu/drm/msm/msm_atomic.c
>>> @@ -228,6 +228,8 @@ void msm_atomic_commit_tail(struct 
>>> drm_atomic_state *state)
>>>       if (kms->funcs->prepare_commit)
>>>           kms->funcs->prepare_commit(kms, state);
>>> +    kms->fault_snapshot_capture = 0;
>>> +
>>
>> - Please move it before the prepare_commit().
>> - You are accessing the same variable from different threads / cores.
>>    There should be some kind of a sync barrier.
> 
> Hi Dmitry,
> 
> Ack, will add a lock for the snapshot capture counter.
> 
> Thanks,
> 
> Jessica Zhang
> 

We cannot have a mutex lock because msm_kms_fault_handler cannot hold a 
mutex. So we need an atomic variable in this case.

>>
>>>       /*
>>>        * Push atomic updates down to hardware:
>>>        */
>>> diff --git a/drivers/gpu/drm/msm/msm_kms.c 
>>> b/drivers/gpu/drm/msm/msm_kms.c
>>> index 
>>> 78830e446355f77154fa21a5d107635bc88ba3ed..3327caf396d4fc905dc127f09515559c12666dc8 100644
>>> --- a/drivers/gpu/drm/msm/msm_kms.c
>>> +++ b/drivers/gpu/drm/msm/msm_kms.c
>>> @@ -168,7 +168,10 @@ static int msm_kms_fault_handler(void *arg, 
>>> unsigned long iova, int flags, void
>>>   {
>>>       struct msm_kms *kms = arg;
>>> -    msm_disp_snapshot_state(kms->dev);
>>> +    if (!kms->fault_snapshot_capture) {
>>> +        msm_disp_snapshot_state(kms->dev);
>>> +        kms->fault_snapshot_capture++;
>>> +    }
>>>       return -ENOSYS;
>>>   }
>>> diff --git a/drivers/gpu/drm/msm/msm_kms.h 
>>> b/drivers/gpu/drm/msm/msm_kms.h
>>> index 
>>> e60162744c669773b6e5aef824a173647626ab4e..3ac089e26e14b824567f3cd2c62f82a1b9ea9878 100644
>>> --- a/drivers/gpu/drm/msm/msm_kms.h
>>> +++ b/drivers/gpu/drm/msm/msm_kms.h
>>> @@ -128,6 +128,9 @@ struct msm_kms {
>>>       int irq;
>>>       bool irq_requested;
>>> +    /* rate limit the snapshot capture to once per attach */
>>> +    int fault_snapshot_capture;
>>> +
>>>       /* mapper-id used to request GEM buffer mapped for scanout: */
>>>       struct msm_gem_address_space *aspace;
>>>
>>> -- 
>>> 2.34.1
>>>
>>
>> -- 
>> With best wishes
>> Dmitry
> 

Re: [PATCH v2 5/5] drm/msm/dpu: rate limit snapshot capture for mmu faults

[Dmitry Baryshkov]

On Tue, Jan 07, 2025 at 05:34:20PM -0800, Abhinav Kumar wrote:
> 
> 
> On 12/18/2024 1:33 PM, Jessica Zhang wrote:
> > 
> > 
> > On 12/18/2024 3:20 AM, Dmitry Baryshkov wrote:
> > > On Tue, Dec 17, 2024 at 04:27:57PM -0800, Jessica Zhang wrote:
> > > > From: Abhinav Kumar <quic_abhinavk@quicinc.com>
> > > > 
> > > > There is no recovery mechanism in place yet to recover from mmu
> > > > faults for DPU. We can only prevent the faults by making sure there
> > > > is no misconfiguration.
> > > > 
> > > > Rate-limit the snapshot capture for mmu faults to once per
> > > > msm_atomic_commit_tail() as that should be sufficient to capture
> > > > the snapshot for debugging otherwise there will be a lot of DPU
> > > > snapshots getting captured for the same fault which is redundant
> > > > and also might affect capturing even one snapshot accurately.
> > > > 
> > > > Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
> > > > Signed-off-by: Jessica Zhang <quic_jesszhan@quicinc.com>
> > > > ---
> > > >   drivers/gpu/drm/msm/msm_atomic.c | 2 ++
> > > >   drivers/gpu/drm/msm/msm_kms.c    | 5 ++++-
> > > >   drivers/gpu/drm/msm/msm_kms.h    | 3 +++
> > > >   3 files changed, 9 insertions(+), 1 deletion(-)
> > > > 
> > > > diff --git a/drivers/gpu/drm/msm/msm_atomic.c
> > > > b/drivers/gpu/drm/msm/msm_atomic.c
> > > > index 9c45d641b5212c11078ab38c13a519663d85e10a..9ad7eeb14d4336abd9d8a8eb1382bdddce80508a
> > > > 100644
> > > > --- a/drivers/gpu/drm/msm/msm_atomic.c
> > > > +++ b/drivers/gpu/drm/msm/msm_atomic.c
> > > > @@ -228,6 +228,8 @@ void msm_atomic_commit_tail(struct
> > > > drm_atomic_state *state)
> > > >       if (kms->funcs->prepare_commit)
> > > >           kms->funcs->prepare_commit(kms, state);
> > > > +    kms->fault_snapshot_capture = 0;
> > > > +
> > > 
> > > - Please move it before the prepare_commit().
> > > - You are accessing the same variable from different threads / cores.
> > >    There should be some kind of a sync barrier.
> > 
> > Hi Dmitry,
> > 
> > Ack, will add a lock for the snapshot capture counter.
> > 
> > Thanks,
> > 
> > Jessica Zhang
> > 
> 
> We cannot have a mutex lock because msm_kms_fault_handler cannot hold a
> mutex. So we need an atomic variable in this case.

Or a spinlock.

> 
> > > 
> > > >       /*
> > > >        * Push atomic updates down to hardware:
> > > >        */
> > > > diff --git a/drivers/gpu/drm/msm/msm_kms.c
> > > > b/drivers/gpu/drm/msm/msm_kms.c
> > > > index 78830e446355f77154fa21a5d107635bc88ba3ed..3327caf396d4fc905dc127f09515559c12666dc8
> > > > 100644
> > > > --- a/drivers/gpu/drm/msm/msm_kms.c
> > > > +++ b/drivers/gpu/drm/msm/msm_kms.c
> > > > @@ -168,7 +168,10 @@ static int msm_kms_fault_handler(void *arg,
> > > > unsigned long iova, int flags, void
> > > >   {
> > > >       struct msm_kms *kms = arg;
> > > > -    msm_disp_snapshot_state(kms->dev);
> > > > +    if (!kms->fault_snapshot_capture) {
> > > > +        msm_disp_snapshot_state(kms->dev);
> > > > +        kms->fault_snapshot_capture++;
> > > > +    }
> > > >       return -ENOSYS;
> > > >   }
> > > > diff --git a/drivers/gpu/drm/msm/msm_kms.h
> > > > b/drivers/gpu/drm/msm/msm_kms.h
> > > > index e60162744c669773b6e5aef824a173647626ab4e..3ac089e26e14b824567f3cd2c62f82a1b9ea9878
> > > > 100644
> > > > --- a/drivers/gpu/drm/msm/msm_kms.h
> > > > +++ b/drivers/gpu/drm/msm/msm_kms.h
> > > > @@ -128,6 +128,9 @@ struct msm_kms {
> > > >       int irq;
> > > >       bool irq_requested;
> > > > +    /* rate limit the snapshot capture to once per attach */
> > > > +    int fault_snapshot_capture;
> > > > +
> > > >       /* mapper-id used to request GEM buffer mapped for scanout: */
> > > >       struct msm_gem_address_space *aspace;
> > > > 
> > > > -- 
> > > > 2.34.1
> > > > 
> > > 
> > > -- 
> > > With best wishes
> > > Dmitry
> > 

-- 
With best wishes
Dmitry