[PATCH i-g-t v2 0/9] msm: recovery and mapping updates

[PATCH i-g-t v2 0/9] msm: recovery and mapping updates

[Rob Clark]

Mostly updates to address flakes, and updates related to newer kernels.
Plus a few additional sub-tests.

Rob Clark (9):
  tests/msm/msm_mapping: Fix memory leak
  tests/msm/msm_recovery: Wait for devcore
  tests/msm/msm_recovery: add iova-fault-stress test
  tests/msm/msm_mapping: update for sparse
  tests/msm/msm_mapping: Handle BO names with spaces
  tests/msm/msm_mapping: Add additional subtests
  tests/msm/msm_mapping: Wait for devcore
  tests/msm/msm_mapping: Handle larger gmem file size
  tests/msm/msm_mapping: Add wait for stall-on-fault to re-arm

 tests/msm/msm_mapping.c  | 93 +++++++++++++++++++++++++++++++++++-----
 tests/msm/msm_recovery.c | 38 +++++++++++-----
 2 files changed, 110 insertions(+), 21 deletions(-)

-- 
2.50.0

[PATCH i-g-t v2 1/9] tests/msm/msm_mapping: Fix memory leak

[Rob Clark]

We shouldn't leak the devcore.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index ac20ca91d613..1749a670e70d 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -215,6 +215,8 @@ do_mapping_test(struct msm_pipe *pipe, const char *buffername, bool write)
 	ret = sscanf(s, "  - iova=%"PRIx64, &fault_addr);
 	igt_fail_on(ret != 1);
 	igt_fail_on(addr != fault_addr);
+
+	free(devcore);
 }
 
 /*
-- 
2.50.0

[PATCH i-g-t v2 2/9] tests/msm/msm_recovery: Wait for devcore

[Rob Clark]

The devcore could take some time to show up, so add a igt_wait() with
timeout so we don't fail the test if the devcore is not immediately
available.

This addresses a source of flakeyness.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_recovery.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/msm/msm_recovery.c b/tests/msm/msm_recovery.c
index fbe26e687ed3..433392079bd4 100644
--- a/tests/msm/msm_recovery.c
+++ b/tests/msm/msm_recovery.c
@@ -44,8 +44,12 @@ read_and_clear_devcore(void)
 	glob_t glob_buf = {0};
 	int ret, fd;
 
-	ret = glob("/sys/class/devcoredump/devcd*/data", GLOB_NOSORT, NULL, &glob_buf);
-	if ((ret == GLOB_NOMATCH) || !glob_buf.gl_pathc)
+	/* The devcore shows up asynchronously, so it might not be
+	 * immediately available:
+	 */
+	if (!igt_wait(glob("/sys/class/devcoredump/devcd*/data",
+			   GLOB_NOSORT, NULL, &glob_buf) != GLOB_NOMATCH,
+		      1000, 100))
 		return;
 
 	fd = open(glob_buf.gl_pathv[0], O_RDWR);
-- 
2.50.0

[PATCH i-g-t v2 3/9] tests/msm/msm_recovery: add iova-fault-stress test

[Rob Clark]

Add a test which triggers many faults to test robustness.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_recovery.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/tests/msm/msm_recovery.c b/tests/msm/msm_recovery.c
index 433392079bd4..7b6e3d76e087 100644
--- a/tests/msm/msm_recovery.c
+++ b/tests/msm/msm_recovery.c
@@ -195,6 +195,22 @@ do_parallel_test(struct msm_pipe *pipe, int child)
 	igt_msm_cmd_free(cmd);
 }
 
+static void
+do_fault_test(struct msm_pipe *pipe, bool stress)
+{
+	struct msm_cmd *cmd = igt_msm_cmd_new(pipe, 0x10000);
+	unsigned int cnt = stress ? 0x10000 / 16 : 1;
+
+	for (unsigned int i = 0; i < cnt; i++) {
+		msm_cmd_pkt7(cmd, CP_MEM_WRITE, 3);
+		msm_cmd_emit(cmd, 0xdeaddead);           /* ADDR_LO */
+		msm_cmd_emit(cmd, 0x1);                  /* ADDR_HI */
+		msm_cmd_emit(cmd, 0x123);                /* VAL */
+	}
+
+	igt_wait_and_close(igt_msm_cmd_submit(cmd));
+}
+
 /*
  * Tests for drm/msm hangcheck, recovery, and fault handling
  */
@@ -242,18 +258,16 @@ igt_main
 
 	igt_describe("Test iova fault handling");
 	igt_subtest("iova-fault") {
-		struct msm_cmd *cmd;
-
 		igt_require(dev->gen >= 6);
 
-		cmd = igt_msm_cmd_new(pipe, 0x1000);
+		do_fault_test(pipe, false);
+	}
 
-		msm_cmd_pkt7(cmd, CP_MEM_WRITE, 3);
-		msm_cmd_emit(cmd, 0xdeaddead);           /* ADDR_LO */
-		msm_cmd_emit(cmd, 0x1);                  /* ADDR_HI */
-		msm_cmd_emit(cmd, 0x123);                /* VAL */
+	igt_describe("Test iova fault handling (stress)");
+	igt_subtest("iova-fault-stress") {
+		igt_require(dev->gen >= 6);
 
-		igt_wait_and_close(igt_msm_cmd_submit(cmd));
+		do_fault_test(pipe, true);
 	}
 
 	igt_fixture {
-- 
2.50.0

[PATCH i-g-t v2 4/9] tests/msm/msm_mapping: update for sparse

[Rob Clark]

The debugfs format changes a bit.  Update the igt test to handle both
cases.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index 1749a670e70d..64dc62c3cda6 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -147,7 +147,11 @@ get_bo_addr(int drm_fd, const char *name)
 			igt_fail_on(!line);
 
 			ret = sscanf(line, "      vmas: [gpu: aspace=%"PRIx64", %"PRIx64",mapped,inuse=1]",
-					&dummy, &addr);
+				     &dummy, &addr);
+			if (ret != 2) {
+				ret = sscanf(line, "      vmas: [gpu: vm=%"PRIx64", %"PRIx64", mapped]",
+					     &dummy, &addr);
+			}
 			igt_fail_on(ret != 2);
 
 			return addr;
-- 
2.50.0

[PATCH i-g-t v2 5/9] tests/msm/msm_mapping: Handle BO names with spaces

[Rob Clark]

Instead of trimming at the first space, scan from the end of the string
until we reach the first non-space char.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index 64dc62c3cda6..923bf8734bd2 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -101,13 +101,15 @@ endswith(const char *str, const char *end)
 
 	/* Trim trailing whitespace: */
 	if (p) {
-		char *c = p;
-		while (c) {
+		char *c = p + strlen(p) - 1;
+
+		while (c > p) {
 			if (isspace(*c)) {
 				*c = '\0';
+			} else {
 				break;
 			}
-			c++;
+			c--;
 		}
 	}
 
-- 
2.50.0

[PATCH i-g-t v2 6/9] tests/msm/msm_mapping: Add additional subtests

[Rob Clark]

Test a few additional buffers that userspace should not have access to.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index 923bf8734bd2..95f5f5635881 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -256,6 +256,36 @@ igt_main
 		do_mapping_test(pipe, "shadow", false);
 	}
 
+	igt_describe("Test pwrup_reglist mapping, should be inaccessible");
+	igt_subtest("pwrup_reglist") {
+		do_mapping_test(pipe, "pwrup_reglist", true);
+		do_mapping_test(pipe, "pwrup_reglist", false);
+	}
+
+	igt_describe("Test memptrs mapping, should be inaccessible");
+	igt_subtest("memptrs") {
+		/*
+		 * This test will fail on older GPUs without HW_APRIV, but
+		 * there isn't a good way to test that from userspace, short
+		 * of maintaining a giant table.  Probably just easier to
+		 * list it in xfails or skips for those GPUs.
+		 */
+		do_mapping_test(pipe, "memptrs", true);
+		do_mapping_test(pipe, "memptrs", false);
+	}
+
+	igt_describe("Test 'preempt_record ring0' mapping, should be inaccessible");
+	igt_subtest("preempt_record_ring0") {
+		do_mapping_test(pipe, "preempt_record ring0", true);
+		do_mapping_test(pipe, "preempt_record ring0", false);
+	}
+
+	igt_describe("Test 'preempt_smmu_info ring0' mapping, should be inaccessible");
+	igt_subtest("preempt_smmu_info_ring0") {
+		do_mapping_test(pipe, "preempt_smmu_info ring0", true);
+		do_mapping_test(pipe, "preempt_smmu_info ring0", false);
+	}
+
 	igt_fixture {
 		igt_msm_pipe_close(pipe);
 		igt_msm_dev_close(dev);
-- 
2.50.0

[PATCH i-g-t v2 7/9] tests/msm/msm_mapping: Wait for devcore

[Rob Clark]

The devcore could take some time to show up, so add a igt_wait() with
timeout so we don't fail the test if the devcore is not immediately
available.

This addresses a source of flakeyness.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index 95f5f5635881..1e166570787d 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -42,14 +42,18 @@
  */
 
 static char *
-get_and_clear_devcore(void)
+get_and_clear_devcore(int timeout_ms)
 {
 	glob_t glob_buf = {0};
 	char *buf = NULL;
-	int ret, fd;
+	int fd;
 
-	ret = glob("/sys/class/devcoredump/devcd*/data", GLOB_NOSORT, NULL, &glob_buf);
-	if ((ret == GLOB_NOMATCH) || !glob_buf.gl_pathc)
+	/* The devcore shows up asynchronously, so it might not be
+	 * immediately available:
+	 */
+	if (!igt_wait(glob("/sys/class/devcoredump/devcd*/data",
+			   GLOB_NOSORT, NULL, &glob_buf) != GLOB_NOMATCH,
+		      timeout_ms, 100))
 		return NULL;
 
 	fd = open(glob_buf.gl_pathv[0], O_RDWR);
@@ -176,7 +180,7 @@ do_mapping_test(struct msm_pipe *pipe, const char *buffername, bool write)
 	int fence_fd, ret;
 
 	/* Clear any existing devcore's: */
-	while ((devcore = get_and_clear_devcore())) {
+	while ((devcore = get_and_clear_devcore(0))) {
 		free(devcore);
 	}
 
@@ -209,7 +213,7 @@ do_mapping_test(struct msm_pipe *pipe, const char *buffername, bool write)
 	/* And now we should have gotten a devcore from the iova fault
 	 * triggered by the read or write:
 	 */
-	devcore = get_and_clear_devcore();
+	devcore = get_and_clear_devcore(1000);
 	igt_fail_on(!devcore);
 
 	/* Make sure the devcore is from iova fault: */
-- 
2.50.0

[PATCH i-g-t v2 8/9] tests/msm/msm_mapping: Handle larger gmem file size

[Rob Clark]

If running on a system with full desktop environment, the file will be
much larger than 0x4000 bytes.

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index 1e166570787d..f820467a3ad2 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -123,7 +123,7 @@ endswith(const char *str, const char *end)
 static uint64_t
 get_bo_addr(int drm_fd, const char *name)
 {
-	char buf[0x4000];
+	char buf[0x80000];
 	char *p = buf;
 
 	igt_debugfs_read(drm_fd, "gem", buf);
-- 
2.50.0

[PATCH i-g-t v2 9/9] tests/msm/msm_mapping: Add wait for stall-on-fault to re-arm

[Rob Clark]

Newer msm driver disable stall-on-fault for a grace period, to avoid
a flood of faults causing instability with memory translations that
the hw attempts with the translation stalled.  Fortunately it adds a
debugfs file so we can know how long we need to wait for stall-on-
fault to be re-enabled.

See: https://lore.kernel.org/all/20250520-msm-gpu-fault-fixes-next-v7-0-96cd1cc9ae05@gmail.com/

Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>
---
 tests/msm/msm_mapping.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
index f820467a3ad2..d224a413cbf2 100644
--- a/tests/msm/msm_mapping.c
+++ b/tests/msm/msm_mapping.c
@@ -74,6 +74,30 @@ get_and_clear_devcore(int timeout_ms)
 	return buf;
 }
 
+static void
+wait_for_stall_on_fault(int drm_fd)
+{
+	char buf[64] = "\0";
+
+	do {
+		int us;
+
+		igt_debugfs_read(drm_fd, "stall_reenable_time_us", buf);
+		if (!strlen(buf)) {
+			/* Not supported on older kernels: */
+			return;
+		}
+
+		us = atoi(buf);
+		if (!us) {
+			/* Done waiting: */
+			return;
+		}
+
+		usleep(us);
+	} while (true);
+}
+
 /*
  * Helper to find named buffer address
  */
@@ -227,6 +251,11 @@ do_mapping_test(struct msm_pipe *pipe, const char *buffername, bool write)
 	igt_fail_on(addr != fault_addr);
 
 	free(devcore);
+
+	/* Wait for stall-on-fault to re-enable, otherwise the next sub-test
+	 * would not generate a devcore:
+	 */
+	wait_for_stall_on_fault(pipe->dev->fd);
 }
 
 /*
-- 
2.50.0

Re: [PATCH i-g-t v2 1/9] tests/msm/msm_mapping: Fix memory leak

[Kamil Konieczny]

Hi Rob,
On 2025-07-02 at 12:02:41 -0700, Rob Clark wrote:
> We shouldn't leak the devcore.
> 
> Signed-off-by: Rob Clark <rob.clark@oss.qualcomm.com>

For whole series this is
Acked-by: Kamil Konieczny <kamil.konieczny@linux.intel.com>

> ---
>  tests/msm/msm_mapping.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/tests/msm/msm_mapping.c b/tests/msm/msm_mapping.c
> index ac20ca91d613..1749a670e70d 100644
> --- a/tests/msm/msm_mapping.c
> +++ b/tests/msm/msm_mapping.c
> @@ -215,6 +215,8 @@ do_mapping_test(struct msm_pipe *pipe, const char *buffername, bool write)
>  	ret = sscanf(s, "  - iova=%"PRIx64, &fault_addr);
>  	igt_fail_on(ret != 1);
>  	igt_fail_on(addr != fault_addr);
> +
> +	free(devcore);
>  }
>  
>  /*
> -- 
> 2.50.0
> 

Re: [PATCH i-g-t v2 0/9] msm: recovery and mapping updates

[Kamil Konieczny]

Hi Rob,
On 2025-07-02 at 12:02:40 -0700, Rob Clark wrote:
> Mostly updates to address flakes, and updates related to newer kernels.
> Plus a few additional sub-tests.

Thank you, I merged it.

Regards,
Kamil

> 
> Rob Clark (9):
>   tests/msm/msm_mapping: Fix memory leak
>   tests/msm/msm_recovery: Wait for devcore
>   tests/msm/msm_recovery: add iova-fault-stress test
>   tests/msm/msm_mapping: update for sparse
>   tests/msm/msm_mapping: Handle BO names with spaces
>   tests/msm/msm_mapping: Add additional subtests
>   tests/msm/msm_mapping: Wait for devcore
>   tests/msm/msm_mapping: Handle larger gmem file size
>   tests/msm/msm_mapping: Add wait for stall-on-fault to re-arm
> 
>  tests/msm/msm_mapping.c  | 93 +++++++++++++++++++++++++++++++++++-----
>  tests/msm/msm_recovery.c | 38 +++++++++++-----
>  2 files changed, 110 insertions(+), 21 deletions(-)
> 
> -- 
> 2.50.0
> 

Re: [PATCH i-g-t v2 0/9] msm: recovery and mapping updates

[Rob Clark]

On Fri, Jul 4, 2025 at 9:11 AM Kamil Konieczny
<kamil.konieczny@linux.intel.com> wrote:
>
> Hi Rob,
> On 2025-07-02 at 12:02:40 -0700, Rob Clark wrote:
> > Mostly updates to address flakes, and updates related to newer kernels.
> > Plus a few additional sub-tests.
>
> Thank you, I merged it.

Thanks, I'll send a patch to uprev igt in drm/ci

BR,
-R


> Regards,
> Kamil
>
> >
> > Rob Clark (9):
> >   tests/msm/msm_mapping: Fix memory leak
> >   tests/msm/msm_recovery: Wait for devcore
> >   tests/msm/msm_recovery: add iova-fault-stress test
> >   tests/msm/msm_mapping: update for sparse
> >   tests/msm/msm_mapping: Handle BO names with spaces
> >   tests/msm/msm_mapping: Add additional subtests
> >   tests/msm/msm_mapping: Wait for devcore
> >   tests/msm/msm_mapping: Handle larger gmem file size
> >   tests/msm/msm_mapping: Add wait for stall-on-fault to re-arm
> >
> >  tests/msm/msm_mapping.c  | 93 +++++++++++++++++++++++++++++++++++-----
> >  tests/msm/msm_recovery.c | 38 +++++++++++-----
> >  2 files changed, 110 insertions(+), 21 deletions(-)
> >
> > --
> > 2.50.0
> >