RE: Questions about CXL device (type 3 memory) hotplug

From: Dan Williams <dan.j.williams@intel.com>
To: Vikram Sethi <vsethi@nvidia.com>,
	Dan Williams <dan.j.williams@intel.com>,
	"Yasunori Gotou (Fujitsu)" <y-goto@fujitsu.com>,
	"linux-cxl@vger.kernel.org" <linux-cxl@vger.kernel.org>,
	"catalin.marinas@arm.com" <Catalin.Marinas@arm.com>,
	James Morse <james.morse@arm.com>
Cc: "Natu, Mahesh" <mahesh.natu@intel.com>
Subject: RE: Questions about CXL device (type 3 memory) hotplug
Date: Tue, 6 Jun 2023 13:54:32 -0700	[thread overview]
Message-ID: <647f9d082eb30_142af82944e@dwillia2-xfh.jf.intel.com.notmuch> (raw)
In-Reply-To: <BYAPR12MB3336F5ADDEDBB6245BC2B48DBD489@BYAPR12MB3336.namprd12.prod.outlook.com>

Vikram Sethi wrote:
> Hi Dan, 
> Apologies for the delayed response, was out for a few days. 
> 
> > From: Dan Williams <dan.j.williams@intel.com>
> > Sent: Wednesday, May 24, 2023 4:20 PM
> > To: Vikram Sethi <vsethi@nvidia.com>; Dan Williams
> > <dan.j.williams@intel.com>; Yasunori Gotou (Fujitsu) <y-goto@fujitsu.com>;
> > linux-cxl@vger.kernel.org; catalin.marinas@arm.com; James Morse
> > <james.morse@arm.com>
> > Cc: Natu, Mahesh <mahesh.natu@intel.com>
> > Subject: RE: Questions about CXL device (type 3 memory) hotplug
> > Vikram Sethi wrote:
> > [..]
> > > > I don't understand this failure mode. Accelerator is added, driver
> > > > sets up an HDM decode range and triggers CPU cache invalidation
> > > > before mapping the memory into page tables. Wouldn't the device,
> > > > upon receiving an invalidation request, just snoop its caches and say
> > "nothing for me to do"?
> > >
> > > Device's snoop filter is in a clean reset/power on state. It is not
> > > tracking anything checked out by the host CPU/peer.  If it starts
> > > receiving writebacks or even CleanEvicts for its memory,
> > 
> > CleanEvict is a device-to-host request. We are talking about host-to-device
> > requests which is only SnpData, SnpInv, and SnpCur, right?
> >
> I was referring to MemClnEvct which is a Host request to device (M2S
> req) as captured in table C-3 of the latest specification

Ok, thanks for that clarification.

>  
> > > looks like an unexpected coherency message and i Know of at least one
> > > implementation that triggers an error interrupt in response. I don't
> > > know of a statement In the specification that this is expected and
> > > implementations should ignore. If there is such a statement, could you
> > > please point me to it?
> > 
> > All the specification says (CXL 3.0 3.2.4.4 Host to Device Requests) is what to
> > do *if* the device is holding that cacheline.
> > 
> > If a device fails when it gets one of those requests when it does not hold a
> > line then how can this work in the nominal case of the device not owning any
> > random cacheline?
> 
> I didn't understand. The line in question is owned by the device (it
> is device memory). The device has just been CXL reset or powered up
> and its snoop filter isn't tracking ANY of its lines as checked out by
> the host. The host tells the device it is dropping a line that the
> host had checked out (MemClnEvct) but per the device the host never
> checked anything out. Seems perfectly reasonable for the device to
> think it is an incorrect coherency message and flag an error. What is
> the nominal case that you think is broken?

The case I was considering was a broadcast / anonymous invalidation
event, but now I see that MemClnEvct implies that the line was
previously in the Shared / Exclusive state, so now I see your point. The
host will not send MemClnEvct in the scenario I was envisioning.

> > 
> > > Remove memory needs a cache flush IMO, in a way that prevents
> > > speculative fetches.  This can be done in kernel with uncacheable
> > > mappings alone, if possible in the arch callback, or via FW call.
> > 
> > That assumes that the kernel owns all mappings. I worry about mappings that
> > the kernel cannot see like x86 SMM. That's why it's currently an invalidate
> > before next usage, but I am not opposed to also flushing on remove if the
> > current solution is causing device-failures in practice.
> > 
> > Can you confirm that the current kernel arrangement is causing failures in
> > practice, or is this a theoretical concern? ...and if it is happening in practice do
> > you have the example patch that fixes it?
> Yes, it is causing error interrupts from the device around device
> reset if the host caches are not flushed before the reset.  It is
> currently being worked around via ACPI magic for the cache flush then
> reset, but kernel aware handling of the flush seems more appropriate
> for both hot plug and CXL reset (whether via direct flush or via FW
> calls from arch callbacks).

Makes sense, and yikes "ACPI magic". My concern though as you note above
is the cache line immediately going back to the "Shared" state from
speculation before the HDM decoder space is shutdown. It seems it would
only be safe to invalidate sometime *after* all of the page tables and
HDM decode has been torn down, and suppress any errors that result from
unaccepted writes.

I.e. would something like this solve the immediate problem? Or does the
architecture need to have the address range mapped into tables and
decode operational for the flush to succeed?

diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index 543c4499379e..60d1b5ecf936 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -187,6 +187,15 @@ static int cxl_region_decode_commit(struct cxl_region *cxlr)
 	struct cxl_region_params *p = &cxlr->params;
 	int i, rc = 0;
 
+	/*
+	 * Before the new region goes active, and while the physical address
+	 * range is not mapped in any page tables invalidate any previous cached
+	 * lines in this physical address range.
+	 */
+	rc = cxl_region_invalidate_memregion(cxlr);
+	if (rc)
+		return rc;
+
 	for (i = 0; i < p->nr_targets; i++) {
 		struct cxl_endpoint_decoder *cxled = p->targets[i];
 		struct cxl_memdev *cxlmd = cxled_to_memdev(cxled);
@@ -3158,8 +3167,6 @@ static int cxl_region_probe(struct device *dev)
 		goto out;
 	}
 
-	rc = cxl_region_invalidate_memregion(cxlr);
-
 	/*
 	 * From this point on any path that changes the region's state away from
 	 * CXL_CONFIG_COMMIT is also responsible for releasing the driver.


