[PATCH i-g-t] tests/amdgpu/amd_deadlock: add gfx bad-opcode non-zero-count reset test

Add amdgpu-gfx-priv-fault-badcount-umq: a gfx user-queue bad opcode (0xf2)
whose PACKET3 header carries a non-zero count field but no body. The pipe HW
cannot find the packet end and stalls mid-packet, so a per-queue (vmid) reset
cannot recover it -- only a gfx pipe reset can (once that FW support lands).
Until then the case escalates to a full GPU reset.

Add a priv_fault_badcount_hang IP-block hook to emit the packet.

Signed-off-by: Jesse Zhang <[email protected]>
---
 lib/amdgpu/amd_deadlock_helpers.c | 80 +++++++++++++++++++++++++++++++
 lib/amdgpu/amd_deadlock_helpers.h |  4 ++
 lib/amdgpu/amd_ip_blocks.h        | 11 +++++
 lib/amdgpu/amd_ip_blocks_ex.c     | 24 ++++++++++
 tests/amdgpu/amd_deadlock.c       |  9 ++++
 5 files changed, 128 insertions(+)

diff --git a/lib/amdgpu/amd_deadlock_helpers.c b/lib/amdgpu/amd_deadlock_helpers.c
index 71c82aa91..1ce46422f 100644
--- a/lib/amdgpu/amd_deadlock_helpers.c
+++ b/lib/amdgpu/amd_deadlock_helpers.c
@@ -529,6 +529,16 @@ static void gfx_ring_emit_priv_inst_hang(
 	ring_context->pm4_dw = i;
 }
 
+static void gfx_ring_emit_priv_fault_badcount_hang(
+	const struct amdgpu_ip_block_version *ip_block,
+	struct amdgpu_ring_context *ring_context)
+{
+	uint32_t i = 0;
+
+	ip_block->funcs->priv_fault_badcount_hang(ip_block->funcs, ring_context, &i);
+	ring_context->pm4_dw = i;
+}
+
 /*
  * Fault a user queue with an invalid opcode followed by an endless wait: the
  * bad opcode raises the gfx priv-fault interrupt and the wait hangs the queue
@@ -600,6 +610,76 @@ void amdgpu_priv_fault_ring_helper(amdgpu_device_handle device_handle, unsigned
 	}
 }
 
+/*
+ * Fault a user queue with a bad opcode carrying a non-zero count field and no
+ * body: the pipe HW cannot find the packet end and stalls mid-packet, so a
+ * per-queue (vmid) reset cannot recover it -- only a gfx pipe reset can (once
+ * that FW support is ready). Until then the case escalates to a full GPU reset.
+ */
+void amdgpu_priv_fault_badcount_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
+					    struct pci_addr *pci, bool user_queue)
+{
+	const struct amdgpu_ip_block_version *ip_block;
+	const int write_length = 128;
+	const int pm4_dw = 256;
+	struct amdgpu_ring_context *ring_context;
+	int r = 0;
+
+	ip_block = get_ip_block(device_handle, ip_type);
+	ring_context = calloc(1, sizeof(*ring_context));
+	igt_assert(ring_context);
+
+	if (user_queue) {
+		ip_block->funcs->userq_create(device_handle, ring_context, ip_type);
+	} else {
+		r = amdgpu_cs_ctx_create(device_handle, &ring_context->context_handle);
+		igt_assert_eq(r, 0);
+	}
+
+	ring_context->write_length = write_length;
+	ring_context->pm4 = calloc(pm4_dw, sizeof(*ring_context->pm4));
+	ring_context->pm4_size = pm4_dw;
+	ring_context->res_cnt = 1;
+	ring_context->ring_id = 0;
+	ring_context->user_queue = user_queue;
+	igt_assert(ring_context->pm4);
+
+	r = amdgpu_bo_alloc_and_map_sync(device_handle,
+				    ring_context->write_length * sizeof(uint32_t),
+				    4096, AMDGPU_GEM_DOMAIN_GTT,
+				    AMDGPU_GEM_CREATE_CPU_GTT_USWC,
+				    AMDGPU_VM_MTYPE_UC,
+				    &ring_context->bo,
+				    (void **)&ring_context->bo_cpu,
+				    &ring_context->bo_mc,
+				    &ring_context->va_handle,
+				    ring_context->timeline_syncobj_handle,
+				    ++ring_context->point, user_queue);
+	igt_assert_eq(r, 0);
+	if (user_queue) {
+		r = amdgpu_timeline_syncobj_wait(device_handle,
+			ring_context->timeline_syncobj_handle,
+			ring_context->point);
+		igt_assert_eq(r, 0);
+	}
+
+	memset((void *)ring_context->bo_cpu, 0, ring_context->write_length * sizeof(uint32_t));
+	ring_context->resources[0] = ring_context->bo;
+
+	gfx_ring_emit_priv_fault_badcount_hang(ip_block, ring_context);
+
+	amdgpu_test_exec_cs_helper(device_handle, ip_block->type, ring_context, 0);
+
+	amdgpu_bo_unmap_and_free(ring_context->bo, ring_context->va_handle, ring_context->bo_mc,
+				 ring_context->write_length * sizeof(uint32_t));
+	if (user_queue) {
+		ip_block->funcs->userq_destroy(device_handle, ring_context, ip_type);
+	} else {
+		free(ring_context->pm4);
+		free(ring_context);
+	}
+}
+
 /*
  * Fault a user queue with a privileged INDIRECT_BUFFER (priv-instruction fault)
  * followed by an endless wait: the privileged IB launch raises a fault interrupt
diff --git a/lib/amdgpu/amd_deadlock_helpers.h b/lib/amdgpu/amd_deadlock_helpers.h
index 69c321ef6..0fd5eb59a 100644
--- a/lib/amdgpu/amd_deadlock_helpers.h
+++ b/lib/amdgpu/amd_deadlock_helpers.h
@@ -42,6 +42,10 @@ void
 amdgpu_priv_fault_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
 			      struct pci_addr *pci, bool user_queue);
 
+void
+amdgpu_priv_fault_badcount_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
+				       struct pci_addr *pci, bool user_queue);
+
 void
 amdgpu_priv_inst_ring_helper(amdgpu_device_handle device_handle, unsigned int ip_type,
 			     struct pci_addr *pci, bool user_queue);
diff --git a/lib/amdgpu/amd_ip_blocks.h b/lib/amdgpu/amd_ip_blocks.h
index 427010c2d..40a9735be 100644
--- a/lib/amdgpu/amd_ip_blocks.h
+++ b/lib/amdgpu/amd_ip_blocks.h
@@ -460,6 +460,17 @@ struct amdgpu_ip_funcs {
 		uint32_t *pm4_dw
 	);
 
+	/*
+	 * Emit a bad opcode with a non-zero count field and no body: the pipe HW
+	 * cannot find the packet end and stalls mid-packet, so a per-queue (vmid)
+	 * reset cannot recover it -- only a gfx pipe reset can.
+	 */
+	int (*priv_fault_badcount_hang)(
+		const struct amdgpu_ip_funcs *func,
+		const struct amdgpu_ring_context *context,
+		uint32_t *pm4_dw
+	);
+
 };
 
 extern const struct amdgpu_ip_block_version gfx_v6_0_ip_block;
diff --git a/lib/amdgpu/amd_ip_blocks_ex.c b/lib/amdgpu/amd_ip_blocks_ex.c
index 4655d9dcc..ad384ec33 100644
--- a/lib/amdgpu/amd_ip_blocks_ex.c
+++ b/lib/amdgpu/amd_ip_blocks_ex.c
@@ -228,6 +228,10 @@ static int gfx_ring_priv_inst_hang(const struct amdgpu_ip_funcs *func,
 				   const struct amdgpu_ring_context *ring_context,
 				   uint32_t *pm4_dw);
 
+static int gfx_ring_priv_fault_badcount_hang(const struct amdgpu_ip_funcs *func,
+					     const struct amdgpu_ring_context *ring_context,
+					     uint32_t *pm4_dw);
+
 void amd_ip_blocks_ex_init(struct amdgpu_ip_funcs *funcs)
 {
 	funcs->gfx_program_compute = gfx_program_compute_default;
@@ -240,6 +244,7 @@ void amd_ip_blocks_ex_init(struct amdgpu_ip_funcs *funcs)
 	funcs->wait_reg_mem_hang = gfx_ring_wait_reg_mem_hang;
 	funcs->priv_fault_hang = gfx_ring_priv_fault_hang;
 	funcs->priv_inst_hang = gfx_ring_priv_inst_hang;
+	funcs->priv_fault_badcount_hang = gfx_ring_priv_fault_badcount_hang;
 
 	switch (funcs->family_id) {
 	case AMDGPU_FAMILY_RV:
@@ -358,3 +363,22 @@ gfx_ring_priv_fault_hang(const struct amdgpu_ip_funcs *func,
 	return 0;
 }
 
+/*
+ * Emit a bad opcode (0xf2) with a non-zero count field and no body: the header
+ * claims a body that is never submitted, so the pipe HW cannot find the packet
+ * end and stalls mid-packet. A per-queue (vmid) reset cannot process it; only a
+ * gfx pipe reset can (once that FW support is ready).
+ */
+static int
+gfx_ring_priv_fault_badcount_hang(const struct amdgpu_ip_funcs *func,
+				  const struct amdgpu_ring_context *ring_context,
+				  uint32_t *pm4_dw)
+{
+	uint32_t i = *pm4_dw;
+
+	ring_context->pm4[i++] = PACKET3(0xf2, 0x3fff);
+	*pm4_dw = i;
+
+	return 0;
+}
+
diff --git a/tests/amdgpu/amd_deadlock.c b/tests/amdgpu/amd_deadlock.c
index 1d729eeb4..d66a58859 100644
--- a/tests/amdgpu/amd_deadlock.c
+++ b/tests/amdgpu/amd_deadlock.c
@@ -265,6 +265,15 @@ int igt_main()
 		}
 	}
 
+	igt_describe("Test-gfx-user-queue-bad-opcode-with-nonzero-count-recovers-via-gfx-pipe-reset");
+	igt_subtest_with_dynamic("amdgpu-gfx-priv-fault-badcount-umq") {
+		if (enable_test && userq_arr_cap[AMD_IP_GFX] &&
+			is_reset_enable(AMD_IP_GFX, AMDGPU_RESET_TYPE_PER_QUEUE, &pci)) {
+			igt_dynamic_f("amdgpu-gfx-priv-fault-badcount-umq")
+			amdgpu_priv_fault_badcount_ring_helper(device, AMDGPU_HW_IP_GFX, &pci, true);
+		}
+	}
+
 	igt_describe("Test-per-queue-reset-recovery-of-a-gfx-user-queue-privileged-instruction-fault");
 	igt_subtest_with_dynamic("amdgpu-gfx-priv-inst-umq") {
 		if (enable_test && userq_arr_cap[AMD_IP_GFX] &&
-- 
2.49.0