Skip to content

drm/asahi: G17 shared capacity, bounded ray-query jobs and timeout recovery on 7.3 - #377

Merged
RyanTheTide merged 11 commits into
integration/aurorafrom
gpu/g17-capacity-and-timeouts
Oct 21, 2026
Merged

RyanTheTide merged 11 commits into
integration/aurorafrom
gpu/g17-capacity-and-timeouts

Conversation

@RyanTheTide

Copy link
Copy Markdown

This brings the G17 GPU capacity and timeout work onto the 7.3 line. It's what the Neo daily is moving to.

The first two commits carry Dj's G17 admission and pool-release recovery work from omacom#151 over to 7.3, plus our stamp-wait fixup. On top of that:

  • Shared G17 queue capacity with one admission deadline per compute packet, so a burst of parallel clients can't leave the GPU refusing every new client until reboot. Fault, lost-device and killed-process paths all hand their capacity back.
  • A bounded execution allowance for jobs that carry native ray queries, extended to render helpers and acceleration-structure builds. Long ray-query shaders and big AS builds get time to finish instead of hitting the 2 s watchdog, but there's still a hard ceiling.
  • Repeated-timeout recovery and G17 mailbox stalls are bounded too, and the background pool-release and render-replay polls now expire. Before this a userspace workload could wedge the whole machine through that path.

Tested on the Neo with this exact tree (the 73h kernel) against the 73d daily. The full Neo sweep passed with no regressions: Touch ID, display hotplug, s2idle, rear SS, ISP camera with the leak check, AVD, both mics, the silent speaker path, Bluetooth, games and native Steam, three boots with no WARN or BUG. The GPU side:

  • CTS stride50 at -j4: 0 ENOSPC, where the old daily ran out of capacity and never recovered.
  • ray_query.stress: 25 of 26 pass, no lost device, no hang.
  • The 776-name failing list with our current Mesa: 728 pass, 44 warn, 4 known leftovers, no new failures.
  • Wi-Fi on the in-tree driver: 5 GHz SAE, PSK and transition with 0 of 3,000 pings lost over a loaded 10 minute soak.

🤖 Generated with Claude Code

Carry three of Dj's commits from omacom#151 that the G17
capacity work depends on: "reclaim unused G17 render warming under queue
pressure", "recover unused initial G17 queue IDs for compute" and "find
common addresses for G17 render pool backing". Keep the 7.3 memory
accounting implementation when splitting the common render-pool backing
constructor.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Port Dj's "drm/asahi: wait for pending G17 compute pool releases" from
omacom#151, together with our fixup that treats a
stamp-waiting released queue as admission backpressure.

The first keeps observing pending pool-release consumers even when no
new GPU event arrives and waits for that capacity outside device locks.
The second covers the stamp-retirement interval before a released queue
can become reusable. The killed/quarantined QID recyclers are already
present in the 7.3 base; do not duplicate or weaken those witnesses.

Preserve the normal admission, physical QID identity and pool-release
contracts. Source-derived host controls include four negative controls.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Drop the outer preparation lease before the growth handoff, allowing recovery
to close and join that epoch without waiting on a nested gate entrant. Record
the stable physical QID and release phase before any following fallible step.
Every growth failure/timeout/epoch exit relinquishes that builder ownership,
leaving the published release and old backing for worker consumption even if
the logical owner already closed. Uninstalled failed graphs are cancelled and
destroyed outside the device mutex.

Preserve both old and tentative backing when row/header rearm fails; move
ownership only after all fallible writes. Keep consumed-release vacancy under
collector pressure rather than dropping mappings under the device mutex.

Add native preparation-join KUnit, 128 concurrent production gate handoffs,
production growth abort/commit/close/rearm/witness/collector controls and four
negative mutations. No asynchronous wake or performance series is imported.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
KernelObject::write requires mutable ownership. Preserve that requirement in
the extracted helper and its host allocation boundary.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Leave the uninstalled queue's empty registry entry and unpublished QID reserved
while dropping its graph off the device mutex. Only cancel that exact constructor
reservation after all aliases are gone, while the preparation lease still pins
the session. This retains the existing drop-before-reuse construction obligation
on the new growth-abort path.

Add an actual registry KUnit test for blocked reuse and stale reservation identity,
and 512 production cleanup controls with mutations for early QID return and
mapping destruction under the device mutex.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
The failed growth frame can own replacement pages and client aliases outside the
uninstalled graph. Drop those mappings off-lock before the common cleanup can
cancel the graph's reservation. Retain the preparation lease across both phases.

Exercise the exact production growth cleanup tail as well as its common helper;
512 cycles per boundary reject live tentative aliases, premature QID reuse and
mapping destruction under the device mutex.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Apply the shared-capacity result from fu-g17-capacity-leak-73-v2 onto
883bd87115de82816a0a6f38f66ecbb784002459. Retain the accepted recovery
history and its pool-release polling, exact stamp/drain lifetime witnesses,
growth lease handoff and tentative-alias-before-QID rollback order.

Resolve the overlapping compute/runtime/test policy with shared capacity:
closed owners and constructors remain temporary capacity pressure; all healthy
shared-channel exhaustion is retryable, and item-ring refusal precedes mutation.
Retain the later unpublished-binding rollback and predecessor retirement fixes.
Keep the K1 absolute packet deadline/cancellation propagation and K2's reachable
pool-release mutations, including the updated preparation/growth test adapter.

The resulting source tree is identical to the v2 shared candidate. This linear
composition starts at the accepted recovery head; it does not merge histories
or duplicate recovery fixes whose equivalent shared commits already exist.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Keep the two-second scheduler poll and ordinary-job deadline. Validated
intersection state identifies compute and render ray traversal; allow it
four extra polls without resetting replay or cross-VM credits. The
ten-second allowance remains far below the legacy scheduler fallback and
cannot be extended indefinitely by the ray-query tag.

Exercise the production policy on the host, including exhaustion,
ordinary and unpublished jobs, and the independent cross-VM bound.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
73f already recognizes both render intersection stages, but untagged
helper and transfer jobs ordered behind native traversal can still hit
the other engine watchdog after two seconds. Select the allowance from
the entire validated submission before enqueueing its first command.
Keep ordinary submissions and all admission and ownership gates intact.

AS build kernels do not carry intersection state. Add a feature-gated
AS_BUILD bit in the existing compute flags field; it grants only the
same fixed four additional polls. Reject all other unsupported flags.
Port the production timeout tests to KUnit and cover selection, helper
scope, both render halves, build hints and finite exhaustion. Document
CTS scale, throughput thresholds and the limits of the macOS comparison.
Hardware attribution and completion remain to be qualified separately.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
Prevent compute replay from waiting indefinitely for event-serviced input
fences while holding the device mutex. Bound initial dependency waits and
recovery preparation joins. Queue workload-triggered stop from scheduler
callbacks; halt firmware producers before a bounded stop join and retain
all graph/lease ownership when a borrower has not returned.

Stop on a per-device burst of eight watchdog expirations or eight restart
handshakes within thirty seconds. New VMs, generations and replay cannot
renew that budget or undo terminal loss. Charge render borrowed-graph and
queued-retirement deferrals against the same finite eight-poll bound as
compute attribution; a deferred timeout cannot evade eventual device loss.

G17 RX now uses an oneshot threaded interrupt with a 64-message pass and
an off-lock sleep on exhaustion. G17 non-atomic TX without an IRQ sleeps
instead of polling for 500 ms with interrupts disabled; atomic sends have
a 1 ms cap. Share one absolute TX deadline across contention/retries and
preserve provider/removal/PM/cookie gates.

Add lockdep KUnit for 64 consecutive timeouts during pending recovery,
late borrower return and latched failure; inject permanently full/empty
register models through production mailbox poll/send functions. Document
the audited bounds and the unverified hardware attribution.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
An exited compute client can leave a published pool release without a
scheduler job to time it out. A parked render replay can likewise re-arm
the one-millisecond worker forever while publication remains unavailable.
Timestamp those exact transactions and stop the runtime after ten seconds
without their witness/commit. Wakes, new clients and repeated scans cannot
refresh either deadline. Keep all backing and reservations owned until the
existing consumed-release or stopped-processor boundary.

Exercise the absolute deadline and exhaustion in production-policy KUnit.

Assisted-by: LLM
Signed-off-by: Ryan Murray <ryan@aurorasilicon.org>
@RyanTheTide

Copy link
Copy Markdown
Author

This tree is now the Neo daily (73h). The plain reboot onto it came up with Touch ID ready, 5 GHz SAE connected with no loss, 24 6 GHz channels from the AU v2 package, and no WARN or BUG lines.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant