[PATCH i-g-t V3 3/3] tests/amdgpu/amd_deadlock: add gfx user-queue priv-instruction reset test

Add amdgpu-gfx-priv-inst-umq, a companion to amdgpu-gfx-priv-fault-umq that
exercises a different gfx fault class. It raises a privileged-instruction fault
by launching a privileged INDIRECT_BUFFER (PRIV bit set) from an unprivileged
user queue, followed by a WAIT_REG_MEM that never completes. The queue hangs
cleanly without the CP running off into memory, so the driver recovers it with a
per-queue reset (no full GPU reset). Verified on GFX11/navi31 and GFX12/navi48.

The fault packet is emitted through a new priv_inst_hang IP-block hook
(gfx_ring_priv_inst_hang), mirroring the existing priv_fault_hang path.

Signed-off-by: Jesse Zhang <[email protected]>
---
 lib/amdgpu/amd_deadlock_helpers.c | 81 +++++++++++++++++++++++++++++++
 lib/amdgpu/amd_deadlock_helpers.h |  4 ++
 lib/amdgpu/amd_ip_blocks.h        | 12 +++++
 lib/amdgpu/amd_ip_blocks_ex.c     | 39 +++++++++++++++
 tests/amdgpu/amd_deadlock.c       |  9 ++++
 5 files changed, 145 insertions(+)

diff --git a/lib/amdgpu/amd_deadlock_helpers.c b/lib/amdgpu/amd_deadlock_helpers.c
index 92d816e13..71c82aa91 100644
--- a/lib/amdgpu/amd_deadlock_helpers.c
+++ b/lib/amdgpu/amd_deadlock_helpers.c
@@ -519,6 +519,16 @@ static void gfx_ring_emit_priv_fault_hang(
 	ring_context->pm4_dw = i;
 }
 
+static void gfx_ring_emit_priv_inst_hang(
+	const struct amdgpu_ip_block_version *ip_block,
+	struct amdgpu_ring_context *ring_context)
+{
+	uint32_t i = 0;
+
+	ip_block->funcs->priv_inst_hang(ip_block->funcs, ring_context, &i);
+	ring_context->pm4_dw = i;
+}
+
 /*
  * Fault a user queue with an invalid opcode followed by an endless wait: the
  * bad opcode raises the gfx priv-fault interrupt and the wait hangs the queue
@@ -590,6 +600,77 @@ void amdgpu_priv_fault_ring_helper(amdgpu_device_handle device_handle, unsigned
 	}
 }
 
+/*
+ * Fault a user queue with a privileged INDIRECT_BUFFER (priv-instruction fault)
+ * followed by an endless wait: the privileged IB launch raises a fault interrupt
+ * and the wait hangs the queue cleanly, so the driver recovers it with a
+ * per-queue reset (no full GPU reset). The submit uses the normal (synchronised)
+ * path so it blocks until the per-queue reset completes the fence.
+ */
+void amdgpu_priv_inst_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
+				  struct pci_addr *pci, bool user_queue)
+{
+	const struct amdgpu_ip_block_version *ip_block;
+	const int write_length = 128;
+	const int pm4_dw = 256;
+	struct amdgpu_ring_context *ring_context;
+	int r = 0;
+
+	ip_block = get_ip_block(device_handle, ip_type);
+	ring_context = calloc(1, sizeof(*ring_context));
+	igt_assert(ring_context);
+
+	if (user_queue) {
+		ip_block->funcs->userq_create(device_handle, ring_context, ip_type);
+	} else {
+		r = amdgpu_cs_ctx_create(device_handle, &ring_context->context_handle);
+		igt_assert_eq(r, 0);
+	}
+
+	ring_context->write_length = write_length;
+	ring_context->pm4 = calloc(pm4_dw, sizeof(*ring_context->pm4));
+	ring_context->pm4_size = pm4_dw;
+	ring_context->res_cnt = 1;
+	ring_context->ring_id = 0;
+	ring_context->user_queue = user_queue;
+	igt_assert(ring_context->pm4);
+
+	r = amdgpu_bo_alloc_and_map_sync(device_handle,
+				    ring_context->write_length * sizeof(uint32_t),
+				    4096, AMDGPU_GEM_DOMAIN_GTT,
+				    AMDGPU_GEM_CREATE_CPU_GTT_USWC,
+				    AMDGPU_VM_MTYPE_UC,
+				    &ring_context->bo,
+				    (void **)&ring_context->bo_cpu,
+				    &ring_context->bo_mc,
+				    &ring_context->va_handle,
+				    ring_context->timeline_syncobj_handle,
+				    ++ring_context->point, user_queue);
+	igt_assert_eq(r, 0);
+	if (user_queue) {
+		r = amdgpu_timeline_syncobj_wait(device_handle,
+			ring_context->timeline_syncobj_handle,
+			ring_context->point);
+		igt_assert_eq(r, 0);
+	}
+
+	memset((void *)ring_context->bo_cpu, 0, ring_context->write_length * sizeof(uint32_t));
+	ring_context->resources[0] = ring_context->bo;
+
+	gfx_ring_emit_priv_inst_hang(ip_block, ring_context);
+
+	amdgpu_test_exec_cs_helper(device_handle, ip_block->type, ring_context, 0);
+
+	amdgpu_bo_unmap_and_free(ring_context->bo, ring_context->va_handle, ring_context->bo_mc,
+				 ring_context->write_length * sizeof(uint32_t));
+	if (user_queue) {
+		ip_block->funcs->userq_destroy(device_handle, ring_context, ip_type);
+	} else {
+		free(ring_context->pm4);
+		free(ring_context);
+	}
+}
+
 #define MAX_DMABUF_COUNT 0x20000
 #define MAX_DWORD_COUNT 256
 
diff --git a/lib/amdgpu/amd_deadlock_helpers.h b/lib/amdgpu/amd_deadlock_helpers.h
index 6e69e62cb..69c321ef6 100644
--- a/lib/amdgpu/amd_deadlock_helpers.h
+++ b/lib/amdgpu/amd_deadlock_helpers.h
@@ -41,5 +41,9 @@ amdgpu_hang_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type
 void
 amdgpu_priv_fault_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
 			      struct pci_addr *pci, bool user_queue);
+
+void
+amdgpu_priv_inst_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
+			     struct pci_addr *pci, bool user_queue);
 #endif
 
diff --git a/lib/amdgpu/amd_ip_blocks.h b/lib/amdgpu/amd_ip_blocks.h
index 6e8ac1511..427010c2d 100644
--- a/lib/amdgpu/amd_ip_blocks.h
+++ b/lib/amdgpu/amd_ip_blocks.h
@@ -448,6 +448,18 @@ struct amdgpu_ip_funcs {
 		uint32_t *pm4_dw
 	);
 
+	/*
+	 * Emit a privileged INDIRECT_BUFFER (PRIV bit) from an unprivileged user
+	 * queue followed by a WAIT_REG_MEM hang: this raises a priv-instruction
+	 * fault and the queue then hangs cleanly, so the driver recovers it with a
+	 * per-queue reset.
+	 */
+	int (*priv_inst_hang)(
+		const struct amdgpu_ip_funcs *func,
+		const struct amdgpu_ring_context *context,
+		uint32_t *pm4_dw
+	);
+
 };
 
 extern const struct amdgpu_ip_block_version gfx_v6_0_ip_block;
diff --git a/lib/amdgpu/amd_ip_blocks_ex.c b/lib/amdgpu/amd_ip_blocks_ex.c
index cec0f4d66..4655d9dcc 100644
--- a/lib/amdgpu/amd_ip_blocks_ex.c
+++ b/lib/amdgpu/amd_ip_blocks_ex.c
@@ -224,6 +224,10 @@ static int gfx_ring_priv_fault_hang(const struct amdgpu_ip_funcs *func,
 				    const struct amdgpu_ring_context *ring_context,
 				    uint32_t *pm4_dw);
 
+static int gfx_ring_priv_inst_hang(const struct amdgpu_ip_funcs *func,
+				   const struct amdgpu_ring_context *ring_context,
+				   uint32_t *pm4_dw);
+
 void amd_ip_blocks_ex_init(struct amdgpu_ip_funcs *funcs)
 {
 	funcs->gfx_program_compute = gfx_program_compute_default;
@@ -235,6 +239,7 @@ void amd_ip_blocks_ex_init(struct amdgpu_ip_funcs *funcs)
 	/* Deadlock/hang test hooks */
 	funcs->wait_reg_mem_hang = gfx_ring_wait_reg_mem_hang;
 	funcs->priv_fault_hang = gfx_ring_priv_fault_hang;
+	funcs->priv_inst_hang = gfx_ring_priv_inst_hang;
 
 	switch (funcs->family_id) {
 	case AMDGPU_FAMILY_RV:
@@ -288,6 +293,40 @@ gfx_ring_wait_reg_mem_hang(const struct amdgpu_ip_funcs *func,
 	return 0;
 }
 
+/*
+ * Emit a privileged INDIRECT_BUFFER (PRIV bit set) launched from an
+ * unprivileged user queue, followed by a WAIT_REG_MEM hang. The privileged IB
+ * launch is rejected by the CP with a fault interrupt and the queue then hangs
+ * cleanly, so the driver recovers it with a per-queue reset.
+ */
+static int
+gfx_ring_priv_inst_hang(const struct amdgpu_ip_funcs *func,
+			const struct amdgpu_ring_context *ring_context,
+			uint32_t *pm4_dw)
+{
+	uint32_t i = *pm4_dw;
+
+	/* Privileged IB launch on an unprivileged UMQ -> priv-instruction fault. */
+	ring_context->pm4[i++] = PACKET3(PACKET3_INDIRECT_BUFFER, 2);
+	ring_context->pm4[i++] = lower_32_bits(ring_context->bo_mc) & 0xfffffffc;
+	ring_context->pm4[i++] = upper_32_bits(ring_context->bo_mc);
+	ring_context->pm4[i++] = 4 | (1u << 31); /* IB size (dwords) | PRIV bit */
+
+	/* Then hang cleanly on a WAIT_REG_MEM that never completes. */
+	ring_context->pm4[i++] = PACKET3(PACKET3_WAIT_REG_MEM, 5);
+	ring_context->pm4[i++] = (WAIT_REG_MEM_MEM_SPACE(1) |
+				  WAIT_REG_MEM_FUNCTION(4) |
+				  WAIT_REG_MEM_ENGINE(0));
+	ring_context->pm4[i++] = lower_32_bits(ring_context->bo_mc) & 0xfffffffc;
+	ring_context->pm4[i++] = upper_32_bits(ring_context->bo_mc);
+	ring_context->pm4[i++] = 0;          /* reference value */
+	ring_context->pm4[i++] = 0xffffffff; /* and mask */
+	ring_context->pm4[i++] = 0x00000004; /* poll interval */
+	*pm4_dw = i;
+
+	return 0;
+}
+
 /*
  * Emit an invalid opcode followed by a WAIT_REG_MEM hang for priv-fault tests.
  * The invalid opcode raises CP_BAD_OPCODE_ERROR (a gfx priv-fault) without
diff --git a/tests/amdgpu/amd_deadlock.c b/tests/amdgpu/amd_deadlock.c
index 0d0e4ba6e..1d729eeb4 100644
--- a/tests/amdgpu/amd_deadlock.c
+++ b/tests/amdgpu/amd_deadlock.c
@@ -264,6 +264,15 @@ int igt_main()
 			amdgpu_priv_fault_ring_helper(device, AMDGPU_HW_IP_GFX, &pci, true);
 		}
 	}
+
+	igt_describe("Test-per-queue-reset-recovery-of-a-gfx-user-queue-privileged-instruction-fault");
+	igt_subtest_with_dynamic("amdgpu-gfx-priv-inst-umq") {
+		if (enable_test && userq_arr_cap[AMD_IP_GFX] &&
+			is_reset_enable(AMD_IP_GFX, AMDGPU_RESET_TYPE_PER_QUEUE, &pci)) {
+			igt_dynamic_f("amdgpu-gfx-priv-inst-umq")
+			amdgpu_priv_inst_ring_helper(device, AMDGPU_HW_IP_GFX, &pci, true);
+		}
+	}
 #endif
 
 	igt_fixture() {
-- 
2.49.0